diff options
authorLinus Torvalds2017-04-02 19:10:08 -0500
committerGreg Kroah-Hartman2018-02-22 08:45:01 -0600
commit42e9b08a7a6151b048540cb312b100a0da5cc497 (patch)
parent4b35dcb5e048cde1a68603d5ad2d8ccaf3fb1e4e (diff)
vfs: don't do RCU lookup of empty pathnames
commit c0eb027e5aef70b71e5a38ee3e264dc0b497f343 upstream. Normal pathname lookup doesn't allow empty pathnames, but using AT_EMPTY_PATH (with name_to_handle_at() or fstatat(), for example) you can trigger an empty pathname lookup. And not only is the RCU lookup in that case entirely unnecessary (because we'll obviously immediately finalize the end result), it is actively wrong. Why? An empth path is a special case that will return the original 'dirfd' dentry - and that dentry may not actually be RCU-free'd, resulting in a potential use-after-free if we were to initialize the path lazily under the RCU read lock and depend on complete_walk() finalizing the dentry. Found by syzkaller and KASAN. Reported-by: Dmitry Vyukov <dvyukov@google.com> Reported-by: Vegard Nossum <vegard.nossum@gmail.com> Acked-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Eric Biggers <ebiggers3@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/namei.c b/fs/namei.c
index 3f96ae087488..844da20232b9 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2000,6 +2000,9 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
2000 int retval = 0; 2000 int retval = 0;
2001 const char *s = nd->name->name; 2001 const char *s = nd->name->name;
2002 2002
2003 if (!*s)
2004 flags &= ~LOOKUP_RCU;
2003 nd->last_type = LAST_ROOT; /* if there are only slashes... */ 2006 nd->last_type = LAST_ROOT; /* if there are only slashes... */
2004 nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT; 2007 nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT;
2005 nd->depth = 0; 2008 nd->depth = 0;