BackPup/Linux
1
0 Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-07 05:31:08 -04:00
Code Issues Packages Projects Releases Wiki Activity

dump_common_audit_data(): fix racy accesses to ->d_name

Browse Source 
We are not guaranteed the locking environment that would prevent
dentry getting renamed right under us.  And it's possible for
old long name to be freed after rename, leading to UAF here.

Cc: [email protected] # v2.6.2+
Signed-off-by: Al Viro <[email protected]>
This commit is contained in:
Al Viro committed 2021-01-16 15:11:35 -05:00
1 parent a959a9782f
commit d36a1dd9f7
1 file changed
+5 -2
Download Patch File Download Diff File Expand all files Collapse all files
security/lsm_audit.c
+5 -2
View File
@@ -275,7 +275,9 @@ static void dump_common_audit_data(struct audit_buffer *ab,
struct inode *inode;
audit_log_format(ab, " name=");
spin_lock(&a->u.dentry->d_lock);
audit_log_untrustedstring(ab, a->u.dentry->d_name.name);
spin_unlock(&a->u.dentry->d_lock);
inode = d_backing_inode(a->u.dentry);
if (inode) {
@@ -293,8 +295,9 @@ static void dump_common_audit_data(struct audit_buffer *ab,
dentry = d_find_alias(inode);
if (dentry) {
audit_log_format(ab, " name=");
audit_log_untrustedstring(ab,
dentry->d_name.name);
spin_lock(&dentry->d_lock);
audit_log_untrustedstring(ab, dentry->d_name.name);
spin_unlock(&dentry->d_lock);
dput(dentry);
}
audit_log_format(ab, " dev=");