Commit d0cb5018 authored by Al Viro's avatar Al Viro
Browse files

do_last(): fetch directory ->i_mode and ->i_uid before it's too late 



may_create_in_sticky() call is done when we already have dropped the
reference to dir.

Fixes: 30aba665 (namei: allow restricted O_CREAT of FIFOs and regular files)
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 508c8772

fs/namei.c

+10 −7
Original line number Diff line number Diff line
@@ -1001,7 +1001,8 @@ static int may_linkat(struct path *link) 
 * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory

 *			  should be allowed, or not, on files that already

 *			  exist.

 * @dir: the sticky parent directory

 * @dir_mode: mode bits of directory

 * @dir_uid: owner of directory

 * @inode: the inode of the file to open

 *

 * Block an O_CREAT open of a FIFO (or a regular file) when:
@@ -1017,18 +1018,18 @@ static int may_linkat(struct path *link) 
 *

 * Returns 0 if the open is allowed, -ve on error.

 */

static int may_create_in_sticky(struct dentry * const dir,

static int may_create_in_sticky(umode_t dir_mode, kuid_t dir_uid,

				struct inode * const inode)

{

	if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||

	    (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||

	    likely(!(dir->d_inode->i_mode & S_ISVTX)) ||

	    uid_eq(inode->i_uid, dir->d_inode->i_uid) ||

	    likely(!(dir_mode & S_ISVTX)) ||

	    uid_eq(inode->i_uid, dir_uid) ||

	    uid_eq(current_fsuid(), inode->i_uid))

		return 0;



	if (likely(dir->d_inode->i_mode & 0002) ||

	    (dir->d_inode->i_mode & 0020 &&

	if (likely(dir_mode & 0002) ||

	    (dir_mode & 0020 &&

	     ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||

	      (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {

		const char *operation = S_ISFIFO(inode->i_mode) ?
@@ -3201,6 +3202,8 @@ static int do_last(struct nameidata *nd, 
		   struct file *file, const struct open_flags *op)

{

	struct dentry *dir = nd->path.dentry;

	kuid_t dir_uid = dir->d_inode->i_uid;

	umode_t dir_mode = dir->d_inode->i_mode;

	int open_flag = op->open_flag;

	bool will_truncate = (open_flag & O_TRUNC) != 0;

	bool got_write = false;
@@ -3331,7 +3334,7 @@ static int do_last(struct nameidata *nd, 
		error = -EISDIR;

		if (d_is_dir(nd->path.dentry))

			goto out;

		error = may_create_in_sticky(dir,

		error = may_create_in_sticky(dir_mode, dir_uid,

					     d_backing_inode(nd->path.dentry));

		if (unlikely(error))

			goto out;