Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759337AbcCDJIF (ORCPT ); Fri, 4 Mar 2016 04:08:05 -0500 Received: from mx2.suse.de ([195.135.220.15]:59845 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759136AbcCDJDz (ORCPT ); Fri, 4 Mar 2016 04:03:55 -0500 X-Amavis-Alert: BAD HEADER SECTION, Duplicate header field: "References" From: Jiri Slaby To: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Al Viro , Jiri Slaby Subject: [PATCH 3.12 112/116] do_last(): don't let a bogus return value from ->open() et.al. to confuse us Date: Fri, 4 Mar 2016 10:02:37 +0100 Message-Id: <66efd9e7538d2f5823e7d2ccae2b16e8e57b7d15.1457082108.git.jslaby@suse.cz> X-Mailer: git-send-email 2.7.2 In-Reply-To: References: In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 996 Lines: 37 From: Al Viro 3.12-stable review patch. If anyone has any objections, please let me know. =============== commit c80567c82ae4814a41287618e315a60ecf513be6 upstream. ... into returning a positive to path_openat(), which would interpret that as "symlink had been encountered" and proceed to corrupt memory, etc. It can only happen due to a bug in some ->open() instance or in some LSM hook, etc., so we report any such event *and* make sure it doesn't trick us into further unpleasantness. Signed-off-by: Al Viro Signed-off-by: Jiri Slaby --- fs/namei.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/namei.c b/fs/namei.c index d1c0b91b4534..b1b1781faca1 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -3116,6 +3116,10 @@ opened: goto exit_fput; } out: + if (unlikely(error > 0)) { + WARN_ON(1); + error = -EINVAL; + } if (got_write) mnt_drop_write(nd->path.mnt); path_put(&save_parent); -- 2.7.2