diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2024-12-08 09:27:11 +0300 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2025-01-28 03:25:24 +0300 |
| commit | ffeeaada2bddb88078f16ba24f24ce8651c22d5b (patch) | |
| tree | 3d0d9a74f991c156cdd712f2afcad6b299c57dc8 /fs/nfs/namespace.c | |
| parent | 39f644a26600634aee00f179ba42cbe5437fd04f (diff) | |
| download | linux-ffeeaada2bddb88078f16ba24f24ce8651c22d5b.tar.xz | |
nfs: fix ->d_revalidate() UAF on ->d_name accesses
Pass the stable name all the way down to ->rpc_ops->lookup() instances.
Note that passing &dentry->d_name is safe in e.g. nfs_lookup() - it *is*
stable there, as it is in ->create() et.al.
dget_parent() in nfs_instantiate() should be redundant - it'd better be
stable there; if it's not, we have more trouble, since ->d_name would
also be unsafe in such case.
nfs_submount() and nfs4_submount() may or may not require fixes - if
they ever get moved on server with fhandle preserved, we are in trouble
there...
UAF window is fairly narrow here and exfiltration requires the ability
to watch the traffic.
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs/nfs/namespace.c')
| -rw-r--r-- | fs/nfs/namespace.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c index 2d53574da605..973aed9cc5fe 100644 --- a/fs/nfs/namespace.c +++ b/fs/nfs/namespace.c @@ -308,7 +308,7 @@ int nfs_submount(struct fs_context *fc, struct nfs_server *server) int err; /* Look it up again to get its attributes */ - err = server->nfs_client->rpc_ops->lookup(d_inode(parent), dentry, + err = server->nfs_client->rpc_ops->lookup(d_inode(parent), dentry, &dentry->d_name, ctx->mntfh, ctx->clone_data.fattr); dput(parent); if (err != 0) |