linux-kernel - [PATCH 07/24] namei: expand nested

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 20 Apr 2015 19:12:51 +0100
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Neil Brown <neilb@...e.de>, linux-kernel@...r.kernel.org,
	linux-fsdevel@...r.kernel.org
Subject: [PATCH 07/24] namei: expand nested_symlink() in its only caller

From: Al Viro <viro@...iv.linux.org.uk>

Signed-off-by: Al Viro <viro@...iv.linux.org.uk>
---
 fs/namei.c | 61 +++++++++++++++++++++++--------------------------------------
 1 file changed, 23 insertions(+), 38 deletions(-)

diff --git a/fs/namei.c b/fs/namei.c
index 4c6ce01f..a1f6271 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1632,43 +1632,6 @@ out_err:
 }
 
 /*
- * This limits recursive symlink follows to 8, while
- * limiting consecutive symlinks to 40.
- *
- * Without that kind of total limit, nasty chains of consecutive
- * symlinks can cause almost arbitrarily long lookups.
- */
-static inline int nested_symlink(struct path *path, struct nameidata *nd)
-{
-	int res;
-
-	if (unlikely(nd->link_count >= MAX_NESTED_LINKS)) {
-		path_put_conditional(path, nd);
-		path_put(&nd->path);
-		return -ELOOP;
-	}
-	BUG_ON(nd->depth >= MAX_NESTED_LINKS);
-
-	nd->depth++;
-	nd->link_count++;
-
-	do {
-		struct path link = *path;
-		void *cookie;
-
-		res = follow_link(&link, nd, &cookie);
-		if (res)
-			break;
-		res = walk_component(nd, path, LOOKUP_FOLLOW);
-		put_link(nd, &link, cookie);
-	} while (res > 0);
-
-	nd->link_count--;
-	nd->depth--;
-	return res;
-}
-
-/*
  * We can do the critical dentry name comparison and hashing
  * operations one word at a time, but we are limited to:
  *
@@ -1859,7 +1822,29 @@ static int link_path_walk(const char *name, struct nameidata *nd)
 			return err;
 
 		if (err) {
-			err = nested_symlink(&next, nd);
+			if (unlikely(nd->link_count >= MAX_NESTED_LINKS)) {
+				path_put_conditional(&next, nd);
+				path_put(&nd->path);
+				return -ELOOP;
+			}
+			BUG_ON(nd->depth >= MAX_NESTED_LINKS);
+
+			nd->depth++;
+			nd->link_count++;
+
+			do {
+				struct path link = next;
+				void *cookie;
+
+				err = follow_link(&link, nd, &cookie);
+				if (err)
+					break;
+				err = walk_component(nd, &next, LOOKUP_FOLLOW);
+				put_link(nd, &link, cookie);
+			} while (err > 0);
+
+			nd->link_count--;
+			nd->depth--;
 			if (err)
 				return err;
 		}
-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/