ovl: Fix info leak in ovl_lookup_temp() (6a45b362) · Commits · 戴 / test

The function uses the memory address of a struct dentry as unique id. While the address-based directory entry is only visible to root it is IMHO still worth fixing since the temporary name does not have to be a kernel address. It can be any unique number. Replace it by an atomic integer which is allowed to wrap around. Signed-off-by:

Richard Weinberger <richard@nod.at> Reviewed-by:

Kees Cook <keescook@chromium.org> Signed-off-by:

Miklos Szeredi <mszeredi@redhat.com> Cc: <stable@vger.kernel.org> # v3.18+ Fixes: ("overlay filesystem")

fs/overlayfs/dir.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -14,6 +14,7 @@
		#include <linux/cred.h>
		#include <linux/posix_acl.h>
		#include <linux/posix_acl_xattr.h>
		#include <linux/atomic.h>
		#include "overlayfs.h"

		void ovl_cleanup(struct inode wdir, struct dentry wdentry)
		@@ -37,8 +38,10 @@ struct dentry ovl_lookup_temp(struct dentry workdir, struct dentry *dentry)
		{
		struct dentry *temp;
		char name[20];
		static atomic_t temp_id = ATOMIC_INIT(0);

		snprintf(name, sizeof(name), "#%lx", (unsigned long) dentry);
		/* counter is allowed to wrap, since temp dentries are ephemeral */
		snprintf(name, sizeof(name), "#%x", atomic_inc_return(&temp_id));

		temp = lookup_one_len(name, workdir, strlen(name));
		if (!IS_ERR(temp) && temp->d_inode) {

Admin message