linux-kernel - Re: fs/namei.c: Misuse of sequence counts?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20141012001259.GM7996@ZenIV.linux.org.uk>
Date:	Sun, 12 Oct 2014 01:12:59 +0100
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Eric Biggers <ebiggers3@...il.com>
Cc:	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: fs/namei.c: Misuse of sequence counts?

On Sat, Oct 11, 2014 at 05:58:08PM -0500, Eric Biggers wrote:

> In path_init(), said commit added a call to read_seqcount_retry() after loading
> the inode.  I see two problems with this:
> 
>   - The read_seqcount_retry() isn't needed just to load the inode pointer, so
>     the change doesn't seem to accomplish anything.

Huh?  What's to guarantee that dentry hasn't become negative since the
moment we'd fetched the seqcount?  _That_ is the problem we are dealing
with here - link_path_walk() relies on nd->inode being non-NULL.

>   - If the -ECHILD code path actually runs, the reference to the 'struct file'
>     can be leaked.

Umm...  That, OTOH, might be true, _if_ we could hit it on the path where
nd->path comes from file (and descriptor table had been shared).  Which
could happen, if we could get d_drop() done to that sucker for some
reason - other codepaths bumping the seqcount are impossible for pinned
dentry (including that of an opened file).

Which can, indeed, happen on something like NFS.  OK, so all callers of
path_init() should go to the same place where they go on link_path_walk()
failure, like this.  And that's probably what we want in backports; however,
longer term we would be better off with a combined path_init + link_path_walk -
all callers do exactly the same thing there...  OK, that can be in a followup...

Signed-off-by: Al Viro <viro@...iv.linux.org.uk>
---
diff --git a/fs/namei.c b/fs/namei.c
index d20d579..0f64aa4 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1950,7 +1950,7 @@ static int path_lookupat(int dfd, const char *name,
 	err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base);

 	if (unlikely(err))
-		return err;
+		goto out;

 	current->total_link_count = 0;
 	err = link_path_walk(name, nd);
@@ -1982,6 +1982,7 @@ static int path_lookupat(int dfd, const char *name,
 		}
 	}

+out:
 	if (base)
 		fput(base);

@@ -2301,7 +2302,7 @@ path_mountpoint(int dfd, const char *name, struct path *path, unsigned int flags

 	err = path_init(dfd, name, flags | LOOKUP_PARENT, &nd, &base);
 	if (unlikely(err))
-		return err;
+		goto out;

 	current->total_link_count = 0;
 	err = link_path_walk(name, &nd);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/