Skip to content
Commit a411c510 authored by Stefan Berger's avatar Stefan Berger Committed by GONG, Ruiqi
Browse files

ima: Fix use-after-free on a dentry's dname.name

mainline inclusion
from mainline-v6.10-rc1
commit be84f32bb2c981ca670922e047cdde1488b233de
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD0O1
CVE: CVE-2024-39494

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=be84f32bb2c981ca670922e047cdde1488b233de

--------------------------------

->d_name.name can change on rename and the earlier value can be freed;
there are conditions sufficient to stabilize it (->d_lock on dentry,
->d_lock on its parent, ->i_rwsem exclusive on the parent's inode,
rename_lock), but none of those are met at any of the sites. Take a stable
snapshot of the name instead.

Link: https://lore.kernel.org/all/20240202182732.GE2087318@ZenIV/


Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarStefan Berger <stefanb@linux.ibm.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Conflicts:
	security/integrity/ima/ima_api.c
	security/integrity/ima/ima_template_lib.c
[Context conflicts, and changes from `filename.name.name` to `filename.name`
since commit 230c6402 ("ovl_lookup_real_one(): don't bother with
strlen()") from v5.2-rc1 is not merged in this branch, and therefore struct
name_snapshot doesn't have `struct qstr name` as its member.]
Signed-off-by: default avatarGONG, Ruiqi <gongruiqi1@huawei.com>
parent 9441eee4
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment