Merge "do_last(): fetch directory ->i_mode and ->i_uid before it's too late" (e8ebf257) · Commits · e / devices / android_kernel_sony_msm8998

fs/namei.c

+10 −7

Original line number	Original line	Diff line number	Diff line
	@@ -1087,7 +1087,8 @@ static int may_linkat(struct path *link)
	* may_create_in_sticky - Check whether an O_CREAT open in a sticky directory		* may_create_in_sticky - Check whether an O_CREAT open in a sticky directory
	* should be allowed, or not, on files that already		* should be allowed, or not, on files that already
	* exist.		* exist.
	* @dir: the sticky parent directory		* @dir_mode: mode bits of directory
			* @dir_uid: owner of directory
	* @inode: the inode of the file to open		* @inode: the inode of the file to open
	*		*
	* Block an O_CREAT open of a FIFO (or a regular file) when:		* Block an O_CREAT open of a FIFO (or a regular file) when:
	@@ -1103,18 +1104,18 @@ static int may_linkat(struct path *link)
	*		*
	* Returns 0 if the open is allowed, -ve on error.		* Returns 0 if the open is allowed, -ve on error.
	*/		*/
	static int may_create_in_sticky(struct dentry * const dir,		static int may_create_in_sticky(umode_t dir_mode, kuid_t dir_uid,
	struct inode * const inode)		struct inode * const inode)
	{		{
	if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) \|\|		if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) \|\|
	(!sysctl_protected_regular && S_ISREG(inode->i_mode)) \|\|		(!sysctl_protected_regular && S_ISREG(inode->i_mode)) \|\|
	likely(!(dir->d_inode->i_mode & S_ISVTX)) \|\|		likely(!(dir_mode & S_ISVTX)) \|\|
	uid_eq(inode->i_uid, dir->d_inode->i_uid) \|\|		uid_eq(inode->i_uid, dir_uid) \|\|
	uid_eq(current_fsuid(), inode->i_uid))		uid_eq(current_fsuid(), inode->i_uid))
	return 0;		return 0;

	if (likely(dir->d_inode->i_mode & 0002) \|\|		if (likely(dir_mode & 0002) \|\|
	(dir->d_inode->i_mode & 0020 &&		(dir_mode & 0020 &&
	((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) \|\|		((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) \|\|
	(sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {		(sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
	return -EACCES;		return -EACCES;
	@@ -3181,6 +3182,8 @@ static int do_last(struct nameidata *nd,
	int *opened)		int *opened)
	{		{
	struct dentry *dir = nd->path.dentry;		struct dentry *dir = nd->path.dentry;
			kuid_t dir_uid = dir->d_inode->i_uid;
			umode_t dir_mode = dir->d_inode->i_mode;
	int open_flag = op->open_flag;		int open_flag = op->open_flag;
	bool will_truncate = (open_flag & O_TRUNC) != 0;		bool will_truncate = (open_flag & O_TRUNC) != 0;
	bool got_write = false;		bool got_write = false;
	@@ -3333,7 +3336,7 @@ finish_open:
	error = -EISDIR;		error = -EISDIR;
	if (d_is_dir(nd->path.dentry))		if (d_is_dir(nd->path.dentry))
	goto out;		goto out;
	error = may_create_in_sticky(dir,		error = may_create_in_sticky(dir_mode, dir_uid,
	d_backing_inode(nd->path.dentry));		d_backing_inode(nd->path.dentry));
	if (unlikely(error))		if (unlikely(error))
	goto out;		goto out;