Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs
Pull overlayfs fix from Miklos Szeredi:
"This fixes a regression introduced in this cycle"
* 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
ovl: fix possible use after free on redirect dir lookup
+18
-9
+18
-9
fs/overlayfs/namei.c
+18
-9
fs/overlayfs/namei.c
···
154
154
static int ovl_lookup_layer(struct dentry *base, struct ovl_lookup_data *d,
155
155
struct dentry **ret)
156
156
{
157
-
const char *s = d->name.name;
157
+
/* Counting down from the end, since the prefix can change */
158
+
size_t rem = d->name.len - 1;
158
159
struct dentry *dentry = NULL;
159
160
int err;
160
161
161
-
if (*s != '/')
162
+
if (d->name.name[0] != '/')
162
163
return ovl_lookup_single(base, d, d->name.name, d->name.len,
163
164
0, "", ret);
164
165
165
-
while (*s++ == '/' && !IS_ERR_OR_NULL(base) && d_can_lookup(base)) {
166
+
while (!IS_ERR_OR_NULL(base) && d_can_lookup(base)) {
167
+
const char *s = d->name.name + d->name.len - rem;
166
168
const char *next = strchrnul(s, '/');
167
-
size_t slen = strlen(s);
169
+
size_t thislen = next - s;
170
+
bool end = !next[0];
168
171
169
-
if (WARN_ON(slen > d->name.len) ||
170
-
WARN_ON(strcmp(d->name.name + d->name.len - slen, s)))
172
+
/* Verify we did not go off the rails */
173
+
if (WARN_ON(s[-1] != '/'))
171
174
return -EIO;
172
175
173
-
err = ovl_lookup_single(base, d, s, next - s,
174
-
d->name.len - slen, next, &base);
176
+
err = ovl_lookup_single(base, d, s, thislen,
177
+
d->name.len - rem, next, &base);
175
178
dput(dentry);
176
179
if (err)
177
180
return err;
178
181
dentry = base;
179
-
s = next;
182
+
if (end)
183
+
break;
184
+
185
+
rem -= thislen + 1;
186
+
187
+
if (WARN_ON(rem >= d->name.len))
188
+
return -EIO;
180
189
}
181
190
*ret = dentry;
182
191
return 0;