Commit 4c7d0c9c authored by Amir Goldstein's avatar Amir Goldstein Committed by Miklos Szeredi

ovl: fix possible use after free on redirect dir lookup

ovl_lookup_layer() iterates on path elements of d->name.name
but also frees and allocates a new pointer for d->name.name.

For the case of lookup in upper layer, the initial d->name.name
pointer is stable (dentry->d_name), but for lower layers, the
initial d->name.name can be d->redirect, which can be freed during
iteration.

[SzM]
Keep the count of remaining characters in the redirect path and calculate
the current position from that.  This works becuase only the prefix is
modified, the ending always stays the same.

Fixes: 02b69b28 ("ovl: lookup redirects")
Signed-off-by: default avatarAmir Goldstein <amir73il@gmail.com>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
parent 49def185
...@@ -154,29 +154,38 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d, ...@@ -154,29 +154,38 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d,
static int ovl_lookup_layer(struct dentry *base, struct ovl_lookup_data *d, static int ovl_lookup_layer(struct dentry *base, struct ovl_lookup_data *d,
struct dentry **ret) struct dentry **ret)
{ {
const char *s = d->name.name; /* Counting down from the end, since the prefix can change */
size_t rem = d->name.len - 1;
struct dentry *dentry = NULL; struct dentry *dentry = NULL;
int err; int err;
if (*s != '/') if (d->name.name[0] != '/')
return ovl_lookup_single(base, d, d->name.name, d->name.len, return ovl_lookup_single(base, d, d->name.name, d->name.len,
0, "", ret); 0, "", ret);
while (*s++ == '/' && !IS_ERR_OR_NULL(base) && d_can_lookup(base)) { while (!IS_ERR_OR_NULL(base) && d_can_lookup(base)) {
const char *s = d->name.name + d->name.len - rem;
const char *next = strchrnul(s, '/'); const char *next = strchrnul(s, '/');
size_t slen = strlen(s); size_t thislen = next - s;
bool end = !next[0];
if (WARN_ON(slen > d->name.len) || /* Verify we did not go off the rails */
WARN_ON(strcmp(d->name.name + d->name.len - slen, s))) if (WARN_ON(s[-1] != '/'))
return -EIO; return -EIO;
err = ovl_lookup_single(base, d, s, next - s, err = ovl_lookup_single(base, d, s, thislen,
d->name.len - slen, next, &base); d->name.len - rem, next, &base);
dput(dentry); dput(dentry);
if (err) if (err)
return err; return err;
dentry = base; dentry = base;
s = next; if (end)
break;
rem -= thislen + 1;
if (WARN_ON(rem >= d->name.len))
return -EIO;
} }
*ret = dentry; *ret = dentry;
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment