linux-kernel - [PATCH] gen_init_cpio: Avoid race between call to stat() and call to open()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LNX.2.00.1012242125170.28973@swampdragon.chaosbits.net>
Date:	Fri, 24 Dec 2010 21:28:56 +0100 (CET)
From:	Jesper Juhl <jj@...osbits.net>
To:	linux-kernel@...r.kernel.org
cc:	jgarzik@...ox.com
Subject: [PATCH] gen_init_cpio: Avoid race between call to stat() and call
 to open()

Hi,

In usr/gen_init_cpio.c::cpio_mkfile() a call to stat() is made based on 
pathname, subsequently the file is open()'ed and then the value of the 
initial stat() call is used to allocate a buffer. This is not safe since 
the file may change between the call to stat() and the call to open().
Safer to just open() the file and then do fstat() using the filedescriptor 
returned by open.


Signed-off-by: Jesper Juhl <jj@...osbits.net>
---
 gen_init_cpio.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c
index b2b3c2d..7cd4538 100644
--- a/usr/gen_init_cpio.c
+++ b/usr/gen_init_cpio.c
@@ -303,18 +303,18 @@ static int cpio_mkfile(const char *name, const char *location,
 
 	mode |= S_IFREG;
 
-	retval = stat (location, &buf);
-	if (retval) {
-		fprintf (stderr, "File %s could not be located\n", location);
-		goto error;
-	}
-
 	file = open (location, O_RDONLY);
 	if (file < 0) {
 		fprintf (stderr, "File %s could not be opened for reading\n", location);
 		goto error;
 	}
 
+	retval = fstat (file, &buf);
+	if (retval) {
+		fprintf (stderr, "File %s could not be stat()'ed\n", location);
+		goto error;
+	}
+
 	filebuf = malloc(buf.st_size);
 	if (!filebuf) {
 		fprintf (stderr, "out of memory\n");




-- 
Jesper Juhl <jj@...osbits.net>            http://www.chaosbits.net/
Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html
Plain text mails only, please.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/