linux-kernel - Re: [PATCH 2.6.32 00/38] 2.6.32.69-longterm review

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20151130112302.GA2432@1wt.eu>
Date:	Mon, 30 Nov 2015 12:23:02 +0100
From:	Willy Tarreau <w@....eu>
To:	Ben Hutchings <ben@...adent.org.uk>
Cc:	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	ebiederm@...ssion.com
Subject: Re: [PATCH 2.6.32 00/38] 2.6.32.69-longterm review

On Mon, Nov 30, 2015 at 07:51:48AM +0100, Willy Tarreau wrote:
> > Commit 397d425dc26d ("vfs: Test for and handle paths that are
> > unreachable from their mnt_root") is missing.
> 
> OK I'm seeing it in your 3.2 branch, I'll try to backport it.

The code in 2.6.32 looks like a plate of spaghetti, which was heavily
reworked in 2.6.38-rc1 by commit 31e6b01 ("fs: rcu-walk for path lookup").
It even does something suspiciously useless :

		if (this.name[0] == '.') switch (this.len) {
			default:
				break;
			case 2:	
				if (this.name[1] != '.')
					break;
				follow_dotdot(nd);
				inode = nd->path.dentry->d_inode;
				/* fallthrough */
			case 1:
				goto return_reval;
		}

Look how inode is assigned after follow_dotdot() and is never used
between the moment it's assigned and the moment it's re-assigned. I
think I got it right though. I checked that I don't need to pass
via path_put() on exit since follow_dotdot() does it on the error
path. I'd appreciate that you, Eric, or anyone else would review it
though.

Thanks,
Willy

View attachment "0001-vfs-Test-for-and-handle-paths-that-are-unreachable-f.patch" of type "text/plain" (3730 bytes)