fs: prevent use after free in auditing when symlink following was denied

[~andy/linux] / fs / namei.c

diff --git a/fs/namei.c b/fs/namei.c
index a856e7f7b6e32ea624327a96b2865f90099e2328..6d47fac64292e0155ef925ef78be737f4bf826ab 100644 (file)
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -692,9 +692,9 @@ static inline int may_follow_link(struct path *link, struct nameidata *nd)
        if (uid_eq(parent->i_uid, inode->i_uid))
                return 0;
 
+       audit_log_link_denied("follow_link", link);
        path_put_conditional(link, nd);
        path_put(&nd->path);
-       audit_log_link_denied("follow_link", link);
        return -EACCES;
 }
 
@@ -1797,8 +1797,6 @@ static int path_init(int dfd, const char *name, unsigned int flags,
                     struct nameidata *nd, struct file **fp)
 {
        int retval = 0;
-       int fput_needed;
-       struct file *file;
 
        nd->last_type = LAST_ROOT; /* if there are only slashes... */
        nd->flags = flags | LOOKUP_JUMPED;
@@ -1850,44 +1848,41 @@ static int path_init(int dfd, const char *name, unsigned int flags,
                        get_fs_pwd(current->fs, &nd->path);
                }
        } else {
+               struct fd f = fdget_raw(dfd);
                struct dentry *dentry;
 
-               file = fget_raw_light(dfd, &fput_needed);
-               retval = -EBADF;
-               if (!file)
-                       goto out_fail;
+               if (!f.file)
+                       return -EBADF;
 
-               dentry = file->f_path.dentry;
+               dentry = f.file->f_path.dentry;
 
                if (*name) {
-                       retval = -ENOTDIR;
-                       if (!S_ISDIR(dentry->d_inode->i_mode))
-                               goto fput_fail;
+                       if (!S_ISDIR(dentry->d_inode->i_mode)) {
+                               fdput(f);
+                               return -ENOTDIR;
+                       }
 
                        retval = inode_permission(dentry->d_inode, MAY_EXEC);
-                       if (retval)
-                               goto fput_fail;
+                       if (retval) {
+                               fdput(f);
+                               return retval;
+                       }
                }
 
-               nd->path = file->f_path;
+               nd->path = f.file->f_path;
                if (flags & LOOKUP_RCU) {
-                       if (fput_needed)
-                               *fp = file;
+                       if (f.need_put)
+                               *fp = f.file;
                        nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
                        lock_rcu_walk();
                } else {
-                       path_get(&file->f_path);
-                       fput_light(file, fput_needed);
+                       path_get(&nd->path);
+                       fdput(f);
                }
        }
 
        nd->inode = nd->path.dentry->d_inode;
        return 0;
-
-fput_fail:
-       fput_light(file, fput_needed);
-out_fail:
-       return retval;
 }
 
 static inline int lookup_last(struct nameidata *nd, struct path *path)
@@ -3971,7 +3966,7 @@ EXPORT_SYMBOL(user_path_at);
 EXPORT_SYMBOL(follow_down_one);
 EXPORT_SYMBOL(follow_down);
 EXPORT_SYMBOL(follow_up);
-EXPORT_SYMBOL(get_write_access); /* binfmt_aout */
+EXPORT_SYMBOL(get_write_access); /* nfsd */
 EXPORT_SYMBOL(getname);
 EXPORT_SYMBOL(lock_rename);
 EXPORT_SYMBOL(lookup_one_len);