diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2009-12-22 23:45:11 -0500 |
|---|---|---|
| committer | Stefan Bader <stefan.bader@canonical.com> | 2014-11-25 15:20:23 +0100 |
| commit | aab0f17d0e2fdb067e23768add2302e35a33c332 (patch) | |
| tree | 98e585eb9f638e246d0dbbfeea31c55072c5a09d | |
| parent | 5995de1c543967b59cbf3de69da28ba3adcadab2 (diff) | |
| download | linux-2.6.32.y-drm33.z-aab0f17d0e2fdb067e23768add2302e35a33c332.tar.gz | |
fix autofs/afs/etc. magic mountpoint breakage
We end up trying to kfree() nd.last.name on open("/mnt/tmp", O_CREAT)
if /mnt/tmp is an autofs direct mount. The reason is that nd.last_type
is bogus here; we want LAST_BIND for everything of that kind and we
get LAST_NORM left over from finding parent directory.
So make sure that it *is* set properly; set to LAST_BIND before
doing ->follow_link() - for normal symlinks it will be changed
by __vfs_follow_link() and everything else needs it set that way.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
(cherry picked from commit 86acdca1b63e6890540fa19495cfc708beff3d8b)
[wt: fixes CVE-2014-0203]
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
| -rw-r--r-- | fs/namei.c | 1 | ||||
| -rw-r--r-- | fs/proc/base.c | 1 |
2 files changed, 1 insertions, 1 deletions
diff --git a/fs/namei.c b/fs/namei.c index b0afbd427be7ab..0d766d201200f2 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -635,6 +635,7 @@ static __always_inline int __do_follow_link(struct path *path, struct nameidata dget(dentry); } mntget(path->mnt); + nd->last_type = LAST_BIND; cookie = dentry->d_inode->i_op->follow_link(dentry, nd); error = PTR_ERR(cookie); if (!IS_ERR(cookie)) { diff --git a/fs/proc/base.c b/fs/proc/base.c index 67f7dc0a4b67f6..c75c5cdadf95e1 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1381,7 +1381,6 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd) goto out; error = PROC_I(inode)->op.proc_get_link(inode, &nd->path); - nd->last_type = LAST_BIND; out: return ERR_PTR(error); } |