]> code.ossystems Code Review - meta-freescale.git/commitdiff
fs: umount on symlink leaks mnt count, CVE-2014-5045
authorSona Sarmadi <sona.sarmadi@enea.com>
Fri, 5 Sep 2014 12:59:02 +0000 (14:59 +0200)
committerZhenhua Luo <zhenhua.luo@freescale.com>
Tue, 9 Sep 2014 09:17:37 +0000 (17:17 +0800)
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
meta-fsl-ppc/recipes-kernel/linux/files/Fix-for-CVE-2014-5045-fs-umount-on-symlink-leak.patch [new file with mode: 0644]
meta-fsl-ppc/recipes-kernel/linux/linux-qoriq_3.12.bb

diff --git a/meta-fsl-ppc/recipes-kernel/linux/files/Fix-for-CVE-2014-5045-fs-umount-on-symlink-leak.patch b/meta-fsl-ppc/recipes-kernel/linux/files/Fix-for-CVE-2014-5045-fs-umount-on-symlink-leak.patch
new file mode 100644 (file)
index 0000000..1ae600f
--- /dev/null
@@ -0,0 +1,47 @@
+fs: umount on symlink leaks mnt count
+
+commit 295dc39d941dc2ae53d5c170365af4c9d5c16212 upstream.
+
+Currently umount on symlink blocks following umount:
+
+/vz is separate mount
+
+drwxr-xr-x.  2 root root       4096 Jul 19 01:14 testdir
+lrwxrwxrwx.  1 root root         11 Jul 19 01:16 testlink -> /vz/testdir
+umount: /vz/testlink: not mounted (expected)
+
+umount: /vz: device is busy. (unexpected)
+
+In this case mountpoint_last() gets an extra refcount on path->mnt
+
+Upstream-Status: Backport
+
+Signed-off-by: Vasily Averin <vvs@openvz.org>
+Acked-by: Ian Kent <raven@themaw.net>
+Acked-by: Jeff Layton <jlayton@primarydata.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ fs/namei.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/namei.c b/fs/namei.c
+index 187cacf..c199dcc 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -2280,9 +2280,10 @@ done:
+               goto out;
+       }
+       path->dentry = dentry;
+-      path->mnt = mntget(nd->path.mnt);
++      path->mnt = nd->path.mnt;
+       if (should_follow_link(dentry->d_inode, nd->flags & LOOKUP_FOLLOW))
+               return 1;
++      mntget(path->mnt);
+       follow_mount(path);
+       error = 0;
+ out:
+-- 
+1.9.1
+
index 5d9a1f0d081f95810c787c32737e7b3030655fbf..4e9c50b52437ff8821d7ca8469926e7fb3c9e262 100644 (file)
@@ -2,6 +2,7 @@ require recipes-kernel/linux/linux-qoriq.inc
 
 SRC_URI = "git://git.freescale.com/ppc/sdk/linux.git;nobranch=1 \
     file://powerpc-Fix-64-bit-builds-with-binutils-2.24.patch \
+    file://Fix-for-CVE-2014-5045-fs-umount-on-symlink-leak.patch \
 "
 SRCREV = "c29fe1a733308cbe592b3af054a97be1b91cf2dd"