dentry name snapshots

commit 49d31c2f389acfe83417083e1208422b4091cd9e upstream.

take_dentry_name_snapshot() takes a safe snapshot of dentry name;
if the name is a short one, it gets copied into caller-supplied
structure, otherwise an extra reference to external name is grabbed
(those are never modified).  In either case the pointer to stable
string is stored into the same structure.

dentry must be held by the caller of take_dentry_name_snapshot(),
but may be freely dropped afterwards - the snapshot will stay
until destroyed by release_dentry_name_snapshot().

Intended use:
	struct name_snapshot s;

	take_dentry_name_snapshot(&s, dentry);
	...
	access s.name
	...
	release_dentry_name_snapshot(&s);

Replaces fsnotify_oldname_...(), gets used in fsnotify to obtain the name
to pass down with event.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[carnil: backport 4.9: adjust context]
[bwh: Backported to 3.16:
 - External names are not ref-counted, so copy them
 - Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[sw0312.kim: cherry-pick from linux-3.16.y to fix CVE-2017-7533]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Ied190805c27c67c4e02dac3a1260a2eb202301b7

diff --git a/fs/dcache.c b/fs/dcache.c
index 1955570..e3cf8e9 100644 (file)
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -220,6 +220,43 @@ static void __d_free(struct rcu_head *head)
        kmem_cache_free(dentry_cache, dentry); 
 }
 
+void take_dentry_name_snapshot(struct name_snapshot *name, struct dentry *dentry)
+{
+       spin_lock(&dentry->d_lock);
+       if (unlikely(dname_external(dentry))) {
+               u32 len;
+               char *p;
+
+               for (;;) {
+                       len = dentry->d_name.len;
+                       spin_unlock(&dentry->d_lock);
+
+                       p = kmalloc(len + 1, GFP_KERNEL | __GFP_NOFAIL);
+
+                       spin_lock(&dentry->d_lock);
+                       if (dentry->d_name.len <= len)
+                               break;
+                       kfree(p);
+               }
+               memcpy(p, dentry->d_name.name, dentry->d_name.len + 1);
+               spin_unlock(&dentry->d_lock);
+
+               name->name = p;
+       } else {
+               memcpy(name->inline_name, dentry->d_iname, DNAME_INLINE_LEN);
+               spin_unlock(&dentry->d_lock);
+               name->name = name->inline_name;
+       }
+}
+EXPORT_SYMBOL(take_dentry_name_snapshot);
+
+void release_dentry_name_snapshot(struct name_snapshot *name)
+{
+       if (unlikely(name->name != name->inline_name))
+               kfree(name->name);
+}
+EXPORT_SYMBOL(release_dentry_name_snapshot);
+
 /*
  * no locks, please.
  */

diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index 3dde673..6c5bc9d 100644 (file)
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -601,7 +601,7 @@ struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry,
 {
        int error;
        struct dentry *dentry = NULL, *trap;
-       const char *old_name;
+       struct name_snapshot old_name;
 
        trap = lock_rename(new_dir, old_dir);
        /* Source or destination directories don't exist? */
@@ -616,19 +616,19 @@ struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry,
        if (IS_ERR(dentry) || dentry == trap || dentry->d_inode)
                goto exit;
 
-       old_name = fsnotify_oldname_init(old_dentry->d_name.name);
+       take_dentry_name_snapshot(&old_name, old_dentry);
 
        error = simple_rename(old_dir->d_inode, old_dentry, new_dir->d_inode,
                dentry);
        if (error) {
-               fsnotify_oldname_free(old_name);
+               release_dentry_name_snapshot(&old_name);
                goto exit;
        }
        d_move(old_dentry, dentry);
-       fsnotify_move(old_dir->d_inode, new_dir->d_inode, old_name,
+       fsnotify_move(old_dir->d_inode, new_dir->d_inode, old_name.name,
                S_ISDIR(old_dentry->d_inode->i_mode),
                NULL, old_dentry);
-       fsnotify_oldname_free(old_name);
+       release_dentry_name_snapshot(&old_name);
        unlock_rename(new_dir, old_dir);
        dput(dentry);
        return old_dentry;

diff --git a/fs/namei.c b/fs/namei.c
index 7e87e3e..817c0c8 100644 (file)
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3848,7 +3848,7 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 {
        int error;
        int is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
-       const unsigned char *old_name;
+       struct name_snapshot old_name;
 
        if (old_dentry->d_inode == new_dentry->d_inode)
                return 0;
@@ -3867,16 +3867,16 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
        if (!old_dir->i_op->rename)
                return -EPERM;
 
-       old_name = fsnotify_oldname_init(old_dentry->d_name.name);
+       take_dentry_name_snapshot(&old_name, old_dentry);
 
        if (is_dir)
                error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry);
        else
                error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
        if (!error)
-               fsnotify_move(old_dir, new_dir, old_name, is_dir,
+               fsnotify_move(old_dir, new_dir, old_name.name, is_dir,
                              new_dentry->d_inode, old_dentry);
-       fsnotify_oldname_free(old_name);
+       release_dentry_name_snapshot(&old_name);
 
        return error;
 }

diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
index a3153e2..561e3a5 100644 (file)
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -105,16 +105,20 @@ int __fsnotify_parent(struct path *path, struct dentry *dentry, __u32 mask)
        if (unlikely(!fsnotify_inode_watches_children(p_inode)))
                __fsnotify_update_child_dentry_flags(p_inode);
        else if (p_inode->i_fsnotify_mask & mask) {
+               struct name_snapshot name;
+
                /* we are notifying a parent so come up with the new mask which
                 * specifies these are events which came from a child. */
                mask |= FS_EVENT_ON_CHILD;
 
+               take_dentry_name_snapshot(&name, dentry);
                if (path)
                        ret = fsnotify(p_inode, mask, path, FSNOTIFY_EVENT_PATH,
-                                      dentry->d_name.name, 0);
+                                      name.name, 0);
                else
                        ret = fsnotify(p_inode, mask, dentry->d_inode, FSNOTIFY_EVENT_INODE,
-                                      dentry->d_name.name, 0);
+                                      name.name, 0);
+               release_dentry_name_snapshot(&name);
        }
 
        dput(parent);

diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index c1999d1..fb65dc3 100644 (file)
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -412,4 +412,11 @@ static inline bool d_mountpoint(struct dentry *dentry)
 
 extern int sysctl_vfs_cache_pressure;
 
+struct name_snapshot {
+       const char *name;
+       char inline_name[DNAME_INLINE_LEN];
+};
+void take_dentry_name_snapshot(struct name_snapshot *, struct dentry *);
+void release_dentry_name_snapshot(struct name_snapshot *);
+
 #endif /* __LINUX_DCACHE_H */

diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
index a78680a..5d72731 100644 (file)
--- a/include/linux/fsnotify.h
+++ b/include/linux/fsnotify.h
@@ -308,35 +308,4 @@ static inline void fsnotify_change(struct dentry *dentry, unsigned int ia_valid)
        }
 }
 
-#if defined(CONFIG_FSNOTIFY)   /* notify helpers */
-
-/*
- * fsnotify_oldname_init - save off the old filename before we change it
- */
-static inline const unsigned char *fsnotify_oldname_init(const unsigned char *name)
-{
-       return kstrdup(name, GFP_KERNEL);
-}
-
-/*
- * fsnotify_oldname_free - free the name we got from fsnotify_oldname_init
- */
-static inline void fsnotify_oldname_free(const unsigned char *old_name)
-{
-       kfree(old_name);
-}
-
-#else  /* CONFIG_FSNOTIFY */
-
-static inline const char *fsnotify_oldname_init(const unsigned char *name)
-{
-       return NULL;
-}
-
-static inline void fsnotify_oldname_free(const unsigned char *old_name)
-{
-}
-
-#endif /*  CONFIG_FSNOTIFY */
-
 #endif /* _LINUX_FS_NOTIFY_H */