Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Stephen Brennan <stephen.s.brennan@oracle.com>
To:     Al Viro <viro@zeniv.linux.org.uk>
Cc:     linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
        Stephen Brennan <stephen.s.brennan@oracle.com>
Subject: [PATCH v3 0/4] namei: fix use-after-free and adjust calling conventions
Date:   Tue,  7 Sep 2021 17:04:09 -0700
Message-Id: <20210908000413.42264-1-stephen.s.brennan@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?bsqCAodkny92Zqk6CvTFin3OI6ogKbxmpS3/I0DqQty8midT8eaFuLPEcy/k?=
 =?us-ascii?Q?337Fc1nx7QoYJWsspX732D0BaiqJduzDTOhnMSmQ2EMqbWIzzL2Ll12CEvCy?=
 =?us-ascii?Q?Fri1vsE0vSgHAdUOqbI28EUYQ9RRcOIB+xHjgrEmVOY7H6RAFxfSt49vaJ8S?=
 =?us-ascii?Q?5+ZyW+OnqHVTciPWWOxC3CbFn/Q1iIwDrShLoVGsnNAEeCxGHagZwPcEw3Zc?=
 =?us-ascii?Q?jxdjQ3I8b/h457pPFThLQ2UdcS0Wvy5voD4XZui3e9FdwN2xRmWyH+EJMQQF?=
 =?us-ascii?Q?ZGuq6FTZG1tf8wpSuU09odHo+qE86WrqjEnwsWdwfU8cLZnNz6HjhKZYZY4s?=
 =?us-ascii?Q?AY+gJjnQXGFSzyRYpUlgz81H7Xky26oBLdH1bpAZmDh6WbfxfllgCmTOLwUN?=
 =?us-ascii?Q?JTvvlAY1r5JYbpncftbZ+5wjIF3xtVUCpq/BCQafa/jcG9PDiYhpoC/D/2mO?=
 =?us-ascii?Q?Jou0NCNE29iP/Cb6vQ+/mJt67jXtzl8TGzqBGwP8X8x/sJW54n8HRzDIwcaF?=
 =?us-ascii?Q?MB2n2bvhPeHMA/uW/WJl66Oucn2Zo3F/CtnaFIidXYxz8LKSv+g2ViWvn6Qq?=
 =?us-ascii?Q?23oku/E6UjFOzFeZ7tniyv/jFcYx2EiGyYEmEfgvEBpLlm+T1GnZeLiTdm7r?=
 =?us-ascii?Q?Kz1CopbMrvdStlbhEN138M2DkBvj08JACdaw4lHF59WGd5KiNvXf2GvaJgyT?=
 =?us-ascii?Q?P7orQw+6y0GJgd/v2QZU4kRoXNIg3fjpCTyZNRViswfTWMJMqI8nJ/Qx9f4B?=
 =?us-ascii?Q?YUmUl7xcWo4WYw4X7G9xyeUxLaq+uffnBxs08Jx6omY5uVhsyUUHZ9GCq/Wp?=
 =?us-ascii?Q?ugwEPPm9vdIxSwKsmNnAj4eOUVcug8YacQU0lyR9VA5aKZSn0DxRcahzU71H?=
 =?us-ascii?Q?ak5vxuSfVbzPNtlzlQMAynblGfHTAcknrXSVSGvZGDs4opYMcdcUJnS6sI89?=
 =?us-ascii?Q?/86LzLvDVwt06VnFiIwieMo9Rx4JCsL2CH+AoGCEFUTIevu+4CDLpmu9iBZ1?=
 =?us-ascii?Q?safgKxTAdu5TP4KKiyrarnvQbopa5DK5rMmLd/K7YyN6vM+j/pCHzHG3Ou+g?=
 =?us-ascii?Q?EXrYYAhX7mxZI8F1I0hoewjM+46vHDmOjq+BzM89AWlZeqHrj57yeY+m2GYH?=
 =?us-ascii?Q?S1r4QPg4yQYQzT1uXjP2uyf3gu9JALMb3L5MG6EDGY5RZrkNiBqTTFgDW0/O?=
 =?us-ascii?Q?afztSSjQsZ9MD8J2RSHKQOTI5EqWR1T+FUuwg5cHCHYSiC08+s9ltjsoG36u?=
 =?us-ascii?Q?P5yV3bT7CRAdb2IDQxHQOdWL8ZtHtfnlyRVKGRcbVM8IvPy4bmI3Mu8J6fsF?=
 =?us-ascii?Q?o1A68IPec2COKc7W/kW1OZUn?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 57055d9d-d997-40cb-6c31-08d9725c2fb9
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4166.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2021 00:04:11.4686
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: qYYa3+KQr5brmJUPOvROvQWayX1HqMcoQjcWjPPzZufYl5vjKi2PxgklN1WizjWellXtEstaFVf8G7Wwn7KnbOvciWJCPL66C5YF2crywWI=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5147
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10100 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 adultscore=0
 malwarescore=0 mlxscore=0 spamscore=0 bulkscore=0 mlxlogscore=903
 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2109030001 definitions=main-2109070152
X-Proofpoint-ORIG-GUID: ogW6ScaEbD7Ep6faQ2785J3eGIG3wITH
X-Proofpoint-GUID: ogW6ScaEbD7Ep6faQ2785J3eGIG3wITH
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Currently filename_parentat() is inherently buggy, and results in a
use after free bug. But removing it and renaming __filename_parentat()
destroys its symmetry with the other functions:

   __filename_create   filename_create()
   __filename_lookup   filename_lookup()

The ones with leading double-underscores do not free their struct
filename arguments, while the ones without double-underscores always do.

I looked at the callers of filename_create and filename_lookup. All are
small functions which are trivial to modify to include a putname(). It
seems to me that adding a few more lines to these functions is a good
traedoff for better clarity on lifetimes (as it's uncommon for functions
to drop references to their parameters) and better consistency.

This small series fixes the UAF and makes it so all three families of
functions have just one variation, which does *not* free its pathname
arguments.

v3: Split patch 1 into a fix and a rename
v2: Fix double getname in user_path_create()

Stephen Brennan (4):
  namei: Fix use after free in kern_path_locked
  namei: Rename __filename_parentat()
  namei: Standardize callers of filename_lookup()
  namei: Standardize callers of filename_create()

 fs/fs_parser.c |   1 -
 fs/namei.c     | 125 ++++++++++++++++++++++++++-----------------------
 2 files changed, 67 insertions(+), 59 deletions(-)

-- 
2.30.2