Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
eCryptfs: NULL crypt_stat dereference during lookup
If ecryptfs_encrypted_view or ecryptfs_xattr_metadata were being
specified as mount options, a NULL pointer dereference of crypt_stat
was possible during lookup.
This patch moves the crypt_stat assignment into
ecryptfs_lookup_and_interpose_lower(), ensuring that crypt_stat
will not be NULL before we attempt to dereference it.
Thanks to Dan Carpenter and his static analysis tool, smatch, for
finding this bug.
Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
Acked-by: Dustin Kirkland <kirkland@canonical.com>
Cc: Dan Carpenter <error27@gmail.com>
Cc: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
authored by
Tyler Hicks
and committed by
Linus Torvalds
2aac0cf8
8faece5f
+18
-25
+6
-4
fs/ecryptfs/crypto.c
+6
-4
fs/ecryptfs/crypto.c
···
2221
2221
struct dentry *ecryptfs_dir_dentry,
2222
2222
const char *name, size_t name_size)
2223
2223
{
2224
+
struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
2225
+
&ecryptfs_superblock_to_private(
2226
+
ecryptfs_dir_dentry->d_sb)->mount_crypt_stat;
2224
2227
char *decoded_name;
2225
2228
size_t decoded_name_size;
2226
2229
size_t packet_size;
2227
2230
int rc = 0;
2228
2231
2229
-
if ((name_size > ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE)
2232
+
if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
2233
+
&& !(mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
2234
+
&& (name_size > ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE)
2230
2235
&& (strncmp(name, ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX,
2231
2236
ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE) == 0)) {
2232
-
struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
2233
-
&ecryptfs_superblock_to_private(
2234
-
ecryptfs_dir_dentry->d_sb)->mount_crypt_stat;
2235
2237
const char *orig_name = name;
2236
2238
size_t orig_name_size = name_size;
2237
2239
-1
fs/ecryptfs/ecryptfs_kernel.h
-1
fs/ecryptfs/ecryptfs_kernel.h
···
620
620
u32 flags);
621
621
int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
622
622
struct dentry *lower_dentry,
623
-
struct ecryptfs_crypt_stat *crypt_stat,
624
623
struct inode *ecryptfs_dir_inode,
625
624
struct nameidata *ecryptfs_nd);
626
625
int ecryptfs_decode_and_decrypt_filename(char **decrypted_name,
+12
-20
fs/ecryptfs/inode.c
+12
-20
fs/ecryptfs/inode.c
···
246
246
*/
247
247
int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
248
248
struct dentry *lower_dentry,
249
-
struct ecryptfs_crypt_stat *crypt_stat,
250
249
struct inode *ecryptfs_dir_inode,
251
250
struct nameidata *ecryptfs_nd)
252
251
{
···
253
254
struct vfsmount *lower_mnt;
254
255
struct inode *lower_inode;
255
256
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
257
+
struct ecryptfs_crypt_stat *crypt_stat;
256
258
char *page_virt = NULL;
257
259
u64 file_size;
258
260
int rc = 0;
···
314
314
goto out_free_kmem;
315
315
}
316
316
}
317
+
crypt_stat = &ecryptfs_inode_to_private(
318
+
ecryptfs_dentry->d_inode)->crypt_stat;
319
+
/* TODO: lock for crypt_stat comparison */
320
+
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
321
+
ecryptfs_set_default_sizes(crypt_stat);
317
322
rc = ecryptfs_read_and_validate_header_region(page_virt,
318
323
ecryptfs_dentry->d_inode);
319
324
if (rc) {
···
367
362
{
368
363
char *encrypted_and_encoded_name = NULL;
369
364
size_t encrypted_and_encoded_name_size;
370
-
struct ecryptfs_crypt_stat *crypt_stat = NULL;
371
365
struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
372
-
struct ecryptfs_inode_info *inode_info;
373
366
struct dentry *lower_dir_dentry, *lower_dentry;
374
367
int rc = 0;
375
368
···
391
388
}
392
389
if (lower_dentry->d_inode)
393
390
goto lookup_and_interpose;
394
-
inode_info = ecryptfs_inode_to_private(ecryptfs_dentry->d_inode);
395
-
if (inode_info) {
396
-
crypt_stat = &inode_info->crypt_stat;
397
-
/* TODO: lock for crypt_stat comparison */
398
-
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
399
-
ecryptfs_set_default_sizes(crypt_stat);
400
-
}
401
-
if (crypt_stat)
402
-
mount_crypt_stat = crypt_stat->mount_crypt_stat;
403
-
else
404
-
mount_crypt_stat = &ecryptfs_superblock_to_private(
405
-
ecryptfs_dentry->d_sb)->mount_crypt_stat;
406
-
if (!(crypt_stat && (crypt_stat->flags & ECRYPTFS_ENCRYPT_FILENAMES))
407
-
&& !(mount_crypt_stat && (mount_crypt_stat->flags
408
-
& ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)))
391
+
mount_crypt_stat = &ecryptfs_superblock_to_private(
392
+
ecryptfs_dentry->d_sb)->mount_crypt_stat;
393
+
if (!(mount_crypt_stat
394
+
&& (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)))
409
395
goto lookup_and_interpose;
410
396
dput(lower_dentry);
411
397
rc = ecryptfs_encrypt_and_encode_filename(
412
398
&encrypted_and_encoded_name, &encrypted_and_encoded_name_size,
413
-
crypt_stat, mount_crypt_stat, ecryptfs_dentry->d_name.name,
399
+
NULL, mount_crypt_stat, ecryptfs_dentry->d_name.name,
414
400
ecryptfs_dentry->d_name.len);
415
401
if (rc) {
416
402
printk(KERN_ERR "%s: Error attempting to encrypt and encode "
···
418
426
}
419
427
lookup_and_interpose:
420
428
rc = ecryptfs_lookup_and_interpose_lower(ecryptfs_dentry, lower_dentry,
421
-
crypt_stat, ecryptfs_dir_inode,
429
+
ecryptfs_dir_inode,
422
430
ecryptfs_nd);
423
431
goto out;
424
432
out_d_drop: