linux-kernel - Re: [PATCH][securityfs][2.6.34] Drop dentry reference count when mknod fails

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100715145946.GA26067@hallyn.com>
Date:	Thu, 15 Jul 2010 09:59:46 -0500
From:	"Serge E. Hallyn" <serge@...lyn.com>
To:	Tvrtko Ursulin <tvrtko.ursulin@...hos.com>
Cc:	James Morris <jmorris@...ei.org>,
	"greg@...ah.com" <greg@...ah.com>,
	Al Viro <viro@...iv.linux.org.uk>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	linux-security-module@...r.kernel.org
Subject: Re: [PATCH][securityfs][2.6.34] Drop dentry reference count when
 mknod fails

Quoting Tvrtko Ursulin (tvrtko.ursulin@...hos.com):
> 
> lookup_one_len increments dentry reference count which is not decremented
> when the create operation fails. This can cause a kernel BUG at
> fs/dcache.c:676 at unmount time. Also error code returned when new_inode()
> fails was replaced with more appropriate -ENOMEM.
> 
> 
> Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@...hos.com>

Looks right.

Acked-by: Serge E. Hallyn <serge@...lyn.com>

thanks,
-serge

> ---
>  inode.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff -upr linux-2.6.34/security/inode.c linux-2.6.34-new/security/inode.c
> --- linux-2.6.34/security/inode.c       2010-05-16 22:17:36.000000000 +0100
> +++ linux-2.6.34-new/security/inode.c   2010-07-15 13:20:38.133783253 +0100
> @@ -86,7 +86,7 @@ static int mknod(struct inode *dir, stru
>                          int mode, dev_t dev)
>  {
>         struct inode *inode;
> -       int error = -EPERM;
> +       int error = -ENOMEM;
> 
>         if (dentry->d_inode)
>                 return -EEXIST;
> @@ -166,6 +166,8 @@ static int create_by_name(const char *na
>                         error = mkdir(parent->d_inode, *dentry, mode);
>                 else
>                         error = create(parent->d_inode, *dentry, mode);
> +               if (error)
> +                       dput(dentry);
>         } else
>                 error = PTR_ERR(*dentry);
>         mutex_unlock(&parent->d_inode->i_mutex);
> 
> 
> 
> Sophos Plc, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, United Kingdom.
> Company Reg No 2096520. VAT Reg No GB 348 3873 20.
> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/