2012-10-04 23:57:06

by Sasha Levin

Subject: [PATCH] fs: prevent use after free in auditing when symlink following was denied

Commit "fs: add link restriction audit reporting" has added auditing of failed
attempts to follow symlinks. Unfortunately, the auditing was being done after
the struct path structure was released earlier.

Signed-off-by: Sasha Levin <[email protected]>
---
fs/namei.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/namei.c b/fs/namei.c
index aa30d19..6d47fac 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -692,9 +692,9 @@ static inline int may_follow_link(struct path *link, struct nameidata *nd)
if (uid_eq(parent->i_uid, inode->i_uid))
return 0;

+ audit_log_link_denied("follow_link", link);
path_put_conditional(link, nd);
path_put(&nd->path);
- audit_log_link_denied("follow_link", link);
return -EACCES;
}

--
1.7.12

2012-10-05 00:33:28

by Kees Cook

Subject: Re: [PATCH] fs: prevent use after free in auditing when symlink following was denied

On Thu, Oct 04, 2012 at 07:56:40PM -0400, Sasha Levin wrote:
> Commit "fs: add link restriction audit reporting" has added auditing of failed
> attempts to follow symlinks. Unfortunately, the auditing was being done after
> the struct path structure was released earlier.
>
> Signed-off-by: Sasha Levin <[email protected]>

Thanks for catching that!

Cc: [email protected]
Acked-by: Kees Cook <[email protected]>

--
Kees Cook @outflux.net

2012-10-05 00:44:07

by Al Viro

Subject: Re: [PATCH] fs: prevent use after free in auditing when symlink following was denied

On Thu, Oct 04, 2012 at 07:56:40PM -0400, Sasha Levin wrote:
> Commit "fs: add link restriction audit reporting" has added auditing of failed
> attempts to follow symlinks. Unfortunately, the auditing was being done after
> the struct path structure was released earlier.

Applied, and it's -stable fodder as well.