linux-kernel - [PATCH] kernfs: fix dentry unexpected skip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <33710E6CAA200E4583255F4FB666C4E21B5E1D83@G01JPEXMBYT03>
Date:   Fri, 18 May 2018 15:48:31 +0000
From:   "Hatayama, Daisuke" <d.hatayama@...fujitsu.com>
To:     "'gregkh@...uxfoundation.org'" <gregkh@...uxfoundation.org>
CC:     "Okajima, Toshiyuki" <toshi.okajima@...fujitsu.com>,
        "'ebiederm@...stanetworks.com'" <ebiederm@...stanetworks.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: [PATCH] kernfs: fix dentry unexpected skip

kernfs_dir_next_pos() overlooks the situation that the dentry
corresponding to a given pos object has already been inactive. Hence,
when kernfs_dir_pos() returns the dentry with a hash value larger than
the original one, kernfs_dir_next_pos() returns the dentry next to the
one returned by kernfs_dir_pos(). As a result, the dentry returned by
kernfs_dir_pos() is skipped.

To fix this issue, try to find a next node only when the returned
object has a hash value equal to or smaller than the original one.

Signed-off-by: HATAYAMA Daisuke <d.hatayama@...fujitsu.com>
Suggested-by: Toshiyuki Okajima <toshi.okajima@...fujitsu.com>
Cc: Eric W. Biederman <ebiederm@...stanetworks.com>
---
 fs/kernfs/dir.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
index 89d1dc1..8a2f49c 100644
--- a/fs/kernfs/dir.c
+++ b/fs/kernfs/dir.c
@@ -1622,7 +1622,7 @@ static int kernfs_dir_fop_release(struct inode *inode, struct file *filp)
 	struct kernfs_node *parent, ino_t ino, struct kernfs_node *pos)
 {
 	pos = kernfs_dir_pos(ns, parent, ino, pos);
-	if (pos) {
+	if (pos && pos->hash <= ino) {
 		do {
 			struct rb_node *node = rb_next(&pos->rb);
 			if (!node)
-- 
1.7.1