linux-kernel - [PATCH v3 0/4] namei: fix use-after-free and adjust calling conventions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue,  7 Sep 2021 17:04:09 -0700
From:   Stephen Brennan <stephen.s.brennan@...cle.com>
To:     Al Viro <viro@...iv.linux.org.uk>
Cc:     linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        Stephen Brennan <stephen.s.brennan@...cle.com>
Subject: [PATCH v3 0/4] namei: fix use-after-free and adjust calling conventions

Currently filename_parentat() is inherently buggy, and results in a
use after free bug. But removing it and renaming __filename_parentat()
destroys its symmetry with the other functions:

   __filename_create   filename_create()
   __filename_lookup   filename_lookup()

The ones with leading double-underscores do not free their struct
filename arguments, while the ones without double-underscores always do.

I looked at the callers of filename_create and filename_lookup. All are
small functions which are trivial to modify to include a putname(). It
seems to me that adding a few more lines to these functions is a good
traedoff for better clarity on lifetimes (as it's uncommon for functions
to drop references to their parameters) and better consistency.

This small series fixes the UAF and makes it so all three families of
functions have just one variation, which does *not* free its pathname
arguments.

v3: Split patch 1 into a fix and a rename
v2: Fix double getname in user_path_create()

Stephen Brennan (4):
  namei: Fix use after free in kern_path_locked
  namei: Rename __filename_parentat()
  namei: Standardize callers of filename_lookup()
  namei: Standardize callers of filename_create()

 fs/fs_parser.c |   1 -
 fs/namei.c     | 125 ++++++++++++++++++++++++++-----------------------
 2 files changed, 67 insertions(+), 59 deletions(-)

-- 
2.30.2