Attachment 313514 Details for Bug 457858 – Proposed backported patch for RHEL-4.8

[patch] Proposed backported patch for RHEL-4.8

CVE-2008-3275-rhel4.patch (text/plain), 2.23 KB, created by Eugene Teo (Security Response) on 2008-08-06 02:27:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Eugene Teo (Security Response)

Created: 2008-08-06 02:27:20 UTC

Size: 2.23 KB

patch

obsolete

>This is for bz#457864 (CVE-2008-3275).
>
>Backport of upstream commit d70b67c8bc72ee23b55381bd6a884f4796692f77
>
>Lookup can install a child dentry for a deleted directory.  This keeps
>the directory dentry alive, and the inode pinned in the cache and on
>disk, even after all external references have gone away.
>
>This isn't a big problem normally, since memory pressure or umount
>will clear out the directory dentry and its children, releasing the
>inode.  But for UBIFS this causes problems because its orphan area can
>overflow.
>
>Fix this by returning ENOENT for all lookups on a S_DEAD directory
>before creating a child dentry.
>
>Thanks to Zoltan Sogor for noticing this while testing UBIFS, and
>Artem for the excellent analysis of the problem and testing.
>
>Brew build:
>http://brewweb.devel.redhat.com/brew/taskinfo?taskID=1420857
>
>Test status:
>Booted on x86_64. Tested with reproducer. No reoccurrence of the problem.
>
>Signed-off-by: Eugene Teo <eteo@redhat.com>
>---
> fs/namei.c |   19 +++++++++++++++++--
> 1 file changed, 17 insertions(+), 2 deletions(-)
>
>diff -uprN linux-2.6.9.default/fs/namei.c linux-2.6.9/fs/namei.c
>--- linux-2.6.9.default/fs/namei.c	2008-08-03 00:21:50.000000000 +0800
>+++ linux-2.6.9/fs/namei.c	2008-08-05 12:01:41.000000000 +0800
>@@ -413,7 +413,14 @@ static struct dentry * real_lookup(struc
> 	 */
> 	result = d_lookup(parent, name);
> 	if (!result) {
>-		struct dentry * dentry = d_alloc(parent, name);
>+		struct dentry *dentry;
>+
>+		/* Don't create child dentry for a dead directory. */
>+		result = ERR_PTR(-ENOENT);
>+		if (IS_DEADDIR(dir))
>+			goto out_unlock;
>+
>+		dentry = d_alloc(parent, name);
> 		result = ERR_PTR(-ENOMEM);
> 		if (dentry) {
> 			result = dir->i_op->lookup(dir, dentry, nd);
>@@ -422,6 +429,7 @@ static struct dentry * real_lookup(struc
> 			else
> 				result = dentry;
> 		}
>+out_unlock:
> 		up(&dir->i_sem);
> 		return result;
> 	}
>@@ -1073,7 +1081,14 @@ static struct dentry * __lookup_hash(str
> 
> 	dentry = cached_lookup(base, name, nd);
> 	if (!dentry) {
>-		struct dentry *new = d_alloc(base, name);
>+		struct dentry *new;
>+
>+		/* Don't create child dentry for a dead directory. */
>+		dentry = ERR_PTR(-ENOENT);
>+		if (IS_DEADDIR(inode))
>+			goto out;
>+
>+		new = d_alloc(base, name);
> 		dentry = ERR_PTR(-ENOMEM);
> 		if (!new)
> 			goto out;

Actions: View | Diff

Attachments on bug 457858: 313417 | 313514 | 313515