Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'work.sane_pwd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull misc vfs updates from Al Viro:
"Making sure that something like a referral point won't end up as pwd
or root.
The main part is the last commit (fixing mntns_install()); that one
fixes a hard-to-hit race. The fchdir() commit is making fchdir(2) a
bit more robust - it should be impossible to get opened files (even
O_PATH ones) for referral points in the first place, so the existing
checks are OK, but checking the same thing as in chdir(2) is just as
cheap.
The path_init() commit removes a redundant check that shouldn't have
been there in the first place"
* 'work.sane_pwd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
make sure that mntns_install() doesn't end up with referral for root
path_init(): don't bother with checking MAY_EXEC for LOOKUP_ROOT
make sure that fchdir() won't accept referral points, etc.
+55
-21
+40
-8
fs/namei.c
+40
-8
fs/namei.c
···
2142
2142
2143
2143
static const char *path_init(struct nameidata *nd, unsigned flags)
2144
2144
{
2145
-
int retval = 0;
2146
2145
const char *s = nd->name->name;
2147
2146
2148
2147
if (!*s)
···
2153
2154
if (flags & LOOKUP_ROOT) {
2154
2155
struct dentry *root = nd->root.dentry;
2155
2156
struct inode *inode = root->d_inode;
2156
-
if (*s) {
2157
-
if (!d_can_lookup(root))
2158
-
return ERR_PTR(-ENOTDIR);
2159
-
retval = inode_permission(inode, MAY_EXEC);
2160
-
if (retval)
2161
-
return ERR_PTR(retval);
2162
-
}
2157
+
if (*s && unlikely(!d_can_lookup(root)))
2158
+
return ERR_PTR(-ENOTDIR);
2163
2159
nd->path = nd->root;
2164
2160
nd->inode = inode;
2165
2161
if (flags & LOOKUP_RCU) {
···
2252
2258
return walk_component(nd, 0);
2253
2259
}
2254
2260
2261
+
static int handle_lookup_down(struct nameidata *nd)
2262
+
{
2263
+
struct path path = nd->path;
2264
+
struct inode *inode = nd->inode;
2265
+
unsigned seq = nd->seq;
2266
+
int err;
2267
+
2268
+
if (nd->flags & LOOKUP_RCU) {
2269
+
/*
2270
+
* don't bother with unlazy_walk on failure - we are
2271
+
* at the very beginning of walk, so we lose nothing
2272
+
* if we simply redo everything in non-RCU mode
2273
+
*/
2274
+
if (unlikely(!__follow_mount_rcu(nd, &path, &inode, &seq)))
2275
+
return -ECHILD;
2276
+
} else {
2277
+
dget(path.dentry);
2278
+
err = follow_managed(&path, nd);
2279
+
if (unlikely(err < 0))
2280
+
return err;
2281
+
inode = d_backing_inode(path.dentry);
2282
+
seq = 0;
2283
+
}
2284
+
path_to_nameidata(&path, nd);
2285
+
nd->inode = inode;
2286
+
nd->seq = seq;
2287
+
return 0;
2288
+
}
2289
+
2255
2290
/* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
2256
2291
static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
2257
2292
{
···
2289
2266
2290
2267
if (IS_ERR(s))
2291
2268
return PTR_ERR(s);
2269
+
2270
+
if (unlikely(flags & LOOKUP_DOWN)) {
2271
+
err = handle_lookup_down(nd);
2272
+
if (unlikely(err < 0)) {
2273
+
terminate_walk(nd);
2274
+
return err;
2275
+
}
2276
+
}
2277
+
2292
2278
while (!(err = link_path_walk(s, nd))
2293
2279
&& ((err = lookup_last(nd)) > 0)) {
2294
2280
s = trailing_symlink(nd);
+11
-7
fs/namespace.c
+11
-7
fs/namespace.c
···
3462
3462
static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
3463
3463
{
3464
3464
struct fs_struct *fs = current->fs;
3465
-
struct mnt_namespace *mnt_ns = to_mnt_ns(ns);
3465
+
struct mnt_namespace *mnt_ns = to_mnt_ns(ns), *old_mnt_ns;
3466
3466
struct path root;
3467
+
int err;
3467
3468
3468
3469
if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) ||
3469
3470
!ns_capable(current_user_ns(), CAP_SYS_CHROOT) ||
···
3475
3474
return -EINVAL;
3476
3475
3477
3476
get_mnt_ns(mnt_ns);
3478
-
put_mnt_ns(nsproxy->mnt_ns);
3477
+
old_mnt_ns = nsproxy->mnt_ns;
3479
3478
nsproxy->mnt_ns = mnt_ns;
3480
3479
3481
3480
/* Find the root */
3482
-
root.mnt = &mnt_ns->root->mnt;
3483
-
root.dentry = mnt_ns->root->mnt.mnt_root;
3484
-
path_get(&root);
3485
-
while(d_mountpoint(root.dentry) && follow_down_one(&root))
3486
-
;
3481
+
err = vfs_path_lookup(mnt_ns->root->mnt.mnt_root, &mnt_ns->root->mnt,
3482
+
"/", LOOKUP_DOWN, &root);
3483
+
if (err) {
3484
+
/* revert to old namespace */
3485
+
nsproxy->mnt_ns = old_mnt_ns;
3486
+
put_mnt_ns(mnt_ns);
3487
+
return err;
3488
+
}
3487
3489
3488
3490
/* Update the pwd and root */
3489
3491
set_fs_pwd(fs, &root);
+3
-6
fs/open.c
+3
-6
fs/open.c
···
460
460
SYSCALL_DEFINE1(fchdir, unsigned int, fd)
461
461
{
462
462
struct fd f = fdget_raw(fd);
463
-
struct inode *inode;
464
-
int error = -EBADF;
463
+
int error;
465
464
466
465
error = -EBADF;
467
466
if (!f.file)
468
467
goto out;
469
468
470
-
inode = file_inode(f.file);
471
-
472
469
error = -ENOTDIR;
473
-
if (!S_ISDIR(inode->i_mode))
470
+
if (!d_can_lookup(f.file->f_path.dentry))
474
471
goto out_putf;
475
472
476
-
error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
473
+
error = inode_permission(file_inode(f.file), MAY_EXEC | MAY_CHDIR);
477
474
if (!error)
478
475
set_fs_pwd(current->fs, &f.file->f_path);
479
476
out_putf: