Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2016-02-27 19:17:33 -0500
committerSasha Levin <sasha.levin@oracle.com>2016-03-09 13:15:12 -0500
commit3960cde3e356057bd60adce1b625a7d178b9581c (patch)
tree1ff7adf66b38e6302d0690478281792c5d979efa
parent6cb69cb2840d3c18a469d6c42dbdb060bdf2bb04 (diff)
do_last(): don't let a bogus return value from ->open() et.al. to confuse us
[ Upstream commit c80567c82ae4814a41287618e315a60ecf513be6 ] ... into returning a positive to path_openat(), which would interpret that as "symlink had been encountered" and proceed to corrupt memory, etc. It can only happen due to a bug in some ->open() instance or in some LSM hook, etc., so we report any such event *and* make sure it doesn't trick us into further unpleasantness. Cc: stable@vger.kernel.org # v3.6+, at least Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
-rw-r--r--fs/namei.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/namei.c b/fs/namei.c
index ccd7f98d85b9..438572278a9e 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3152,6 +3152,10 @@ opened:
goto exit_fput;
}
out:
+ if (unlikely(error > 0)) {
+ WARN_ON(1);
+ error = -EINVAL;
+ }
if (got_write)
mnt_drop_write(nd->path.mnt);
path_put(&save_parent);