vfs: don't do RCU lookup of empty pathnames
authorLinus Torvalds <torvalds@linux-foundation.org>
Mon, 3 Apr 2017 00:10:08 +0000 (17:10 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Sat, 15 Apr 2017 16:34:52 +0000 (09:34 -0700)
commitc0eb027e5aef70b71e5a38ee3e264dc0b497f343
treeefd915a71eb39b13013fb7566fce12d6a6c764d0
parent1bf4b1268e66d9364fc6fd41f906bc01458530ac
vfs: don't do RCU lookup of empty pathnames

Normal pathname lookup doesn't allow empty pathnames, but using
AT_EMPTY_PATH (with name_to_handle_at() or fstatat(), for example) you
can trigger an empty pathname lookup.

And not only is the RCU lookup in that case entirely unnecessary
(because we'll obviously immediately finalize the end result), it is
actively wrong.

Why? An empth path is a special case that will return the original
'dirfd' dentry - and that dentry may not actually be RCU-free'd,
resulting in a potential use-after-free if we were to initialize the
path lazily under the RCU read lock and depend on complete_walk()
finalizing the dentry.

Found by syzkaller and KASAN.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Reported-by: Vegard Nossum <vegard.nossum@gmail.com>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fs/namei.c