Commit 4e78c724 authored Jun 13, 2011 by Tetsuo Handa Committed by James Morris Jun 14, 2011

TOMOYO: Fix oops in tomoyo_mount_acl().



In tomoyo_mount_acl() since 2.6.36, kern_path() was called without checking
dev_name != NULL. As a result, an unprivileged user can trigger oops by issuing
mount(NULL, "/", "ext3", 0, NULL) request.
Fix this by checking dev_name != NULL before calling kern_path(dev_name).

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: stable@kernel.org
Signed-off-by: James Morris <jmorris@namei.org>

parent 2c53b436

security/tomoyo/mount.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -138,7 +138,7 @@ static int tomoyo_mount_acl(struct tomoyo_request_info r, char dev_name,
		}
		if (need_dev) {
		/* Get mount point or device file. */
		if (kern_path(dev_name, LOOKUP_FOLLOW, &path)) {
		if (!dev_name \|\| kern_path(dev_name, LOOKUP_FOLLOW, &path)) {
		error = -ENOENT;
		goto out;
		}