Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 57f5ee92 authored by Miklos Szeredi's avatar Miklos Szeredi Committed by laxman
Browse files

[CVE-2020-16120] ovl: verify permissions in ovl_path_open()

Change-Id: I834b0b1424245a66e3d396ec90c42041ce5ee781
parent 00438d4b
Loading
Loading
Loading
Loading
+26 −1
Original line number Diff line number Diff line
@@ -493,7 +493,32 @@ bool ovl_is_whiteout(struct dentry *dentry)

struct file *ovl_path_open(struct path *path, int flags)
{
	return dentry_open(path, flags | O_NOATIME, current_cred());
	struct inode *inode = d_inode(path->dentry);
	int err, acc_mode;

	if (flags & ~(O_ACCMODE | O_LARGEFILE))
		BUG();

	switch (flags & O_ACCMODE) {
	case O_RDONLY:
		acc_mode = MAY_READ;
		break;
	case O_WRONLY:
		acc_mode = MAY_WRITE;
		break;
	default:
		BUG();
	}

	err = inode_permission(inode, acc_mode | MAY_OPEN);
	if (err)
		return ERR_PTR(err);

	/* O_NOATIME is an optimization, don't fail if not permitted */
	if (inode_owner_or_capable(inode))
		flags |= O_NOATIME;

	return dentry_open(path, flags, current_cred());
}

/* Caller should hold ovl_inode->lock */