From patchwork Tue Jan 10 15:39:16 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amir Goldstein X-Patchwork-Id: 9508043 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 14490601EA for ; Tue, 10 Jan 2017 15:39:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 072542858A for ; Tue, 10 Jan 2017 15:39:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id EF9AE285AC; Tue, 10 Jan 2017 15:39:39 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 850222859E for ; Tue, 10 Jan 2017 15:39:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S939232AbdAJPji (ORCPT ); Tue, 10 Jan 2017 10:39:38 -0500 Received: from mail-wm0-f66.google.com ([74.125.82.66]:35896 "EHLO mail-wm0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S939187AbdAJPjh (ORCPT ); Tue, 10 Jan 2017 10:39:37 -0500 Received: by mail-wm0-f66.google.com with SMTP id r126so10293732wmr.3 for ; Tue, 10 Jan 2017 07:39:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=vQ5FvD295JEx46SMw/WAQ+1jYNFQtVrJs+6QAgcklJ0=; b=OJGWQxYatCYXrPp9lGHlqfsBQ6KCIPwdve/7YZioY54hWHrU5xnNYsEAVahEAn0sKA L7GLCygv1O0xW4agqylg4kY2HiE4jRrPfC5J6ZYP/uLPnNrp9PHtbHTWc0cwACwKq9zv KenvxfFB7RM28YmHrR/bHXdiZcqvzoahHUEhoSU44lbyImX9hhTrY+7mdhfIz8CyIE8P RBmfgYZ+atmFlgwb7ukQCcUAOqA6TocWuIwpy3MrIwDnqme4JrfWUb2kKf7b61t6Ez3z 6e7qcBU96agOT7KdNVJhNU72yzMZ0BEftQHNEswytuT1gLgdrwp3IcYTL5N+g3hRBOPT Qyjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=vQ5FvD295JEx46SMw/WAQ+1jYNFQtVrJs+6QAgcklJ0=; b=RCEQWMHAaCHkwiyOvvRJCitb5klnG6n/57UM57VHnNHUwFeXuG/lWwL0gcOGsZ9WWZ S95X9edalsm6y9JGQgq0u4+uFJRoZjHioOJwC4/7lDfMkWXntwwsE4NQC4kNncZ2utao kJP+V/HKw7NpgVLYQRI8XF3KY9QtNrCRzBsoYnQxQ+bo08N+6TcfuXk9AAoUTrYn+X83 ew/ENCeYOURoHv10T6yVn9uz4SKq4+ocTjTuS1cXZzi5SebZ2n+BIGdNeRZfyHhQPWcp lS4PNI3lK6gkUccgK1iE8w051B46sARv7usMYjvaZEA/XBn6VefP9oypxC1WRa78XtXB ljMA== X-Gm-Message-State: AIkVDXLPwxjpXoVm4pISxlCYNhvxgou/m1pUSZXNW5eBdJL8QrSXaF3MmivCv9o+NsIMXA== X-Received: by 10.28.14.66 with SMTP id 63mr2143236wmo.127.1484062776429; Tue, 10 Jan 2017 07:39:36 -0800 (PST) Received: from amir-VirtualBox.ctera.local (bzq-82-81-193-202.cablep.bezeqint.net. [82.81.193.202]) by smtp.gmail.com with ESMTPSA id cs4sm3792374wjd.42.2017.01.10.07.39.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 10 Jan 2017 07:39:35 -0800 (PST) From: Amir Goldstein To: "Darrick J . Wong" Cc: Brian Foster , Christoph Hellwig , linux-xfs@vger.kernel.org Subject: [PATCH v7 5/6] xfs: sanity check inode mode when creating new dentry Date: Tue, 10 Jan 2017 17:39:16 +0200 Message-Id: <1484062757-12433-6-git-send-email-amir73il@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1484062757-12433-1-git-send-email-amir73il@gmail.com> References: <1484062757-12433-1-git-send-email-amir73il@gmail.com> Sender: linux-xfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-xfs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The helper xfs_dentry_to_name() is used by 2 different classes of callers: Callers that pass zero mode and don't care about the returned name.type field and Callers that pass non zero mode and do care about the name.type field. Change xfs_dentry_to_name() to not take the mode argument and change the call sites of the first class to not pass the mode argument. Create a new helper xfs_dentry_mode_to_name() which does pass the mode argument and returns -EFSCORRUPTED if mode is invalid. Callers that translate non zero mode to on-disk file type now check the return value and will export the error to user instead of staging an invalid file type to be written to directory entry. Signed-off-by: Amir Goldstein --- fs/xfs/xfs_iops.c | 47 ++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 38 insertions(+), 9 deletions(-) diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c index 821f08d..ef38d0f 100644 --- a/fs/xfs/xfs_iops.c +++ b/fs/xfs/xfs_iops.c @@ -98,12 +98,27 @@ xfs_init_security( static void xfs_dentry_to_name( struct xfs_name *namep, + struct dentry *dentry) +{ + namep->name = dentry->d_name.name; + namep->len = dentry->d_name.len; + namep->type = XFS_DIR3_FT_UNKNOWN; +} + +static int +xfs_dentry_mode_to_name( + struct xfs_name *namep, struct dentry *dentry, int mode) { namep->name = dentry->d_name.name; namep->len = dentry->d_name.len; namep->type = xfs_mode_to_ftype(mode); + + if (unlikely(namep->type == XFS_DIR3_FT_UNKNOWN)) + return -EFSCORRUPTED; + + return 0; } STATIC void @@ -119,7 +134,7 @@ xfs_cleanup_inode( * xfs_init_security we must back out. * ENOSPC can hit here, among other things. */ - xfs_dentry_to_name(&teardown, dentry, 0); + xfs_dentry_to_name(&teardown, dentry); xfs_remove(XFS_I(dir), &teardown, XFS_I(inode)); } @@ -154,8 +169,12 @@ xfs_generic_create( if (error) return error; + /* Verify mode is valid also for tmpfile case */ + error = xfs_dentry_mode_to_name(&name, dentry, mode); + if (unlikely(error)) + goto out_free_acl; + if (!tmpfile) { - xfs_dentry_to_name(&name, dentry, mode); error = xfs_create(XFS_I(dir), &name, mode, rdev, &ip); } else { error = xfs_create_tmpfile(XFS_I(dir), dentry, mode, &ip); @@ -248,7 +267,7 @@ xfs_vn_lookup( if (dentry->d_name.len >= MAXNAMELEN) return ERR_PTR(-ENAMETOOLONG); - xfs_dentry_to_name(&name, dentry, 0); + xfs_dentry_to_name(&name, dentry); error = xfs_lookup(XFS_I(dir), &name, &cip, NULL); if (unlikely(error)) { if (unlikely(error != -ENOENT)) @@ -275,7 +294,7 @@ xfs_vn_ci_lookup( if (dentry->d_name.len >= MAXNAMELEN) return ERR_PTR(-ENAMETOOLONG); - xfs_dentry_to_name(&xname, dentry, 0); + xfs_dentry_to_name(&xname, dentry); error = xfs_lookup(XFS_I(dir), &xname, &ip, &ci_name); if (unlikely(error)) { if (unlikely(error != -ENOENT)) @@ -310,7 +329,9 @@ xfs_vn_link( struct xfs_name name; int error; - xfs_dentry_to_name(&name, dentry, inode->i_mode); + error = xfs_dentry_mode_to_name(&name, dentry, inode->i_mode); + if (unlikely(error)) + return error; error = xfs_link(XFS_I(dir), XFS_I(inode), &name); if (unlikely(error)) @@ -329,7 +350,7 @@ xfs_vn_unlink( struct xfs_name name; int error; - xfs_dentry_to_name(&name, dentry, 0); + xfs_dentry_to_name(&name, dentry); error = xfs_remove(XFS_I(dir), &name, XFS_I(d_inode(dentry))); if (error) @@ -359,7 +380,8 @@ xfs_vn_symlink( mode = S_IFLNK | (irix_symlink_mode ? 0777 & ~current_umask() : S_IRWXUGO); - xfs_dentry_to_name(&name, dentry, mode); + error = xfs_dentry_mode_to_name(&name, dentry, mode); + ASSERT(error == 0); error = xfs_symlink(XFS_I(dir), &name, symname, mode, &cip); if (unlikely(error)) @@ -395,6 +417,7 @@ xfs_vn_rename( { struct inode *new_inode = d_inode(ndentry); int omode = 0; + int error; struct xfs_name oname; struct xfs_name nname; @@ -405,8 +428,14 @@ xfs_vn_rename( if (flags & RENAME_EXCHANGE) omode = d_inode(ndentry)->i_mode; - xfs_dentry_to_name(&oname, odentry, omode); - xfs_dentry_to_name(&nname, ndentry, d_inode(odentry)->i_mode); + error = xfs_dentry_mode_to_name(&oname, odentry, omode); + if (omode && unlikely(error)) + return error; + + error = xfs_dentry_mode_to_name(&nname, ndentry, + d_inode(odentry)->i_mode); + if (unlikely(error)) + return error; return xfs_rename(XFS_I(odir), &oname, XFS_I(d_inode(odentry)), XFS_I(ndir), &nname,