Merge branch 'work.sane_pwd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull misc vfs updates from Al Viro:
 "Making sure that something like a referral point won't end up as pwd
  or root.

  The main part is the last commit (fixing mntns_install()); that one
  fixes a hard-to-hit race. The fchdir() commit is making fchdir(2) a
  bit more robust - it should be impossible to get opened files (even
  O_PATH ones) for referral points in the first place, so the existing
  checks are OK, but checking the same thing as in chdir(2) is just as
  cheap.

  The path_init() commit removes a redundant check that shouldn't have
  been there in the first place"

* 'work.sane_pwd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  make sure that mntns_install() doesn't end up with referral for root
  path_init(): don't bother with checking MAY_EXEC for LOOKUP_ROOT
  make sure that fchdir() won't accept referral points, etc.

diff --git a/fs/namei.c b/fs/namei.c
index 7286f87ce863568bbe1b84f8e432b809118146b5..6571a5f5112ed82894fdbec1c9b6dfaf557d93b1 100644 (file)
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2142,7 +2142,6 @@ OK:
 
 static const char *path_init(struct nameidata *nd, unsigned flags)
 {
-       int retval = 0;
        const char *s = nd->name->name;
 
        if (!*s)
@@ -2154,13 +2153,8 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
        if (flags & LOOKUP_ROOT) {
                struct dentry *root = nd->root.dentry;
                struct inode *inode = root->d_inode;
-               if (*s) {
-                       if (!d_can_lookup(root))
-                               return ERR_PTR(-ENOTDIR);
-                       retval = inode_permission(inode, MAY_EXEC);
-                       if (retval)
-                               return ERR_PTR(retval);
-               }
+               if (*s && unlikely(!d_can_lookup(root)))
+                       return ERR_PTR(-ENOTDIR);
                nd->path = nd->root;
                nd->inode = inode;
                if (flags & LOOKUP_RCU) {
@@ -2258,6 +2252,35 @@ static inline int lookup_last(struct nameidata *nd)
        return walk_component(nd, 0);
 }
 
+static int handle_lookup_down(struct nameidata *nd)
+{
+       struct path path = nd->path;
+       struct inode *inode = nd->inode;
+       unsigned seq = nd->seq;
+       int err;
+
+       if (nd->flags & LOOKUP_RCU) {
+               /*
+                * don't bother with unlazy_walk on failure - we are
+                * at the very beginning of walk, so we lose nothing
+                * if we simply redo everything in non-RCU mode
+                */
+               if (unlikely(!__follow_mount_rcu(nd, &path, &inode, &seq)))
+                       return -ECHILD;
+       } else {
+               dget(path.dentry);
+               err = follow_managed(&path, nd);
+               if (unlikely(err < 0))
+                       return err;
+               inode = d_backing_inode(path.dentry);
+               seq = 0;
+       }
+       path_to_nameidata(&path, nd);
+       nd->inode = inode;
+       nd->seq = seq;
+       return 0;
+}
+
 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
 static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
 {
@@ -2266,6 +2289,15 @@ static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path
 
        if (IS_ERR(s))
                return PTR_ERR(s);
+
+       if (unlikely(flags & LOOKUP_DOWN)) {
+               err = handle_lookup_down(nd);
+               if (unlikely(err < 0)) {
+                       terminate_walk(nd);
+                       return err;
+               }
+       }
+
        while (!(err = link_path_walk(s, nd))
                && ((err = lookup_last(nd)) > 0)) {
                s = trailing_symlink(nd);

diff --git a/fs/namespace.c b/fs/namespace.c
index b3b115bd4e1ee397f01bf0930f5f9900be5878bf..8bd3e4d448b9f07a8aa148c8d08c092f45471a7c 100644 (file)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3462,8 +3462,9 @@ static void mntns_put(struct ns_common *ns)
 static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
 {
        struct fs_struct *fs = current->fs;
-       struct mnt_namespace *mnt_ns = to_mnt_ns(ns);
+       struct mnt_namespace *mnt_ns = to_mnt_ns(ns), *old_mnt_ns;
        struct path root;
+       int err;
 
        if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) ||
            !ns_capable(current_user_ns(), CAP_SYS_CHROOT) ||
@@ -3474,15 +3475,18 @@ static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
                return -EINVAL;
 
        get_mnt_ns(mnt_ns);
-       put_mnt_ns(nsproxy->mnt_ns);
+       old_mnt_ns = nsproxy->mnt_ns;
        nsproxy->mnt_ns = mnt_ns;
 
        /* Find the root */
-       root.mnt    = &mnt_ns->root->mnt;
-       root.dentry = mnt_ns->root->mnt.mnt_root;
-       path_get(&root);
-       while(d_mountpoint(root.dentry) && follow_down_one(&root))
-               ;
+       err = vfs_path_lookup(mnt_ns->root->mnt.mnt_root, &mnt_ns->root->mnt,
+                               "/", LOOKUP_DOWN, &root);
+       if (err) {
+               /* revert to old namespace */
+               nsproxy->mnt_ns = old_mnt_ns;
+               put_mnt_ns(mnt_ns);
+               return err;
+       }
 
        /* Update the pwd and root */
        set_fs_pwd(fs, &root);

diff --git a/fs/open.c b/fs/open.c
index 6d2d2b33ac54e80374a273e331e2954711186e5a..cd0c5be8d01247e8bab3f4e00e6f171803291881 100644 (file)
--- a/fs/open.c
+++ b/fs/open.c
@@ -460,20 +460,17 @@ out:
 SYSCALL_DEFINE1(fchdir, unsigned int, fd)
 {
        struct fd f = fdget_raw(fd);
-       struct inode *inode;
-       int error = -EBADF;
+       int error;
 
        error = -EBADF;
        if (!f.file)
                goto out;
 
-       inode = file_inode(f.file);
-
        error = -ENOTDIR;
-       if (!S_ISDIR(inode->i_mode))
+       if (!d_can_lookup(f.file->f_path.dentry))
                goto out_putf;
 
-       error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
+       error = inode_permission(file_inode(f.file), MAY_EXEC | MAY_CHDIR);
        if (!error)
                set_fs_pwd(current->fs, &f.file->f_path);
 out_putf:

diff --git a/include/linux/namei.h b/include/linux/namei.h
index f29abda31e6dc8b32376a86c6c52e9e9ca6da0a0..8b4794e83196db62997ef5aea81886c3ad800bbd 100644 (file)
--- a/include/linux/namei.h
+++ b/include/linux/namei.h
@@ -44,6 +44,7 @@ enum {LAST_NORM, LAST_ROOT, LAST_DOT, LAST_DOTDOT, LAST_BIND};
 #define LOOKUP_JUMPED          0x1000
 #define LOOKUP_ROOT            0x2000
 #define LOOKUP_EMPTY           0x4000
+#define LOOKUP_DOWN            0x8000
 
 extern int path_pts(struct path *path);