• Eric W. Biederman's avatar
    vfs: Test for and handle paths that are unreachable from their mnt_root · fa6ef735
    Eric W. Biederman authored
    commit 397d425dc26da728396e66d392d5dcb8dac30c37 upstream.
    
    In rare cases a directory can be renamed out from under a bind mount.
    In those cases without special handling it becomes possible to walk up
    the directory tree to the root dentry of the filesystem and down
    from the root dentry to every other file or directory on the filesystem.
    
    Like division by zero .. from an unconnected path can not be given
    a useful semantic as there is no predicting at which path component
    the code will realize it is unconnected.  We certainly can not match
    the current behavior as the current behavior is a security hole.
    
    Therefore when encounting .. when following an unconnected path
    return -ENOENT.
    
    - Add a function path_connected to verify path->dentry is reachable
      from path->mnt.mnt_root.  AKA to validate that rename did not do
      something nasty to the bind mount.
    
      To avoid races path_connected must be called after following a path
      component to it's next path component.
    Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    
    
    fa6ef735
namei.c 101 KB