ima: Fix use-after-free on a dentry's dname.name

Browse source

->d_name.name can change on rename and the earlier value can be freed;
there are conditions sufficient to stabilize it (->d_lock on dentry,
->d_lock on its parent, ->i_rwsem exclusive on the parent's inode,
rename_lock), but none of those are met at any of the sites. Take a stable
snapshot of the name instead.

Link: https://lore.kernel.org/all/20240202182732.GE2087318@ZenIV/
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

...

This commit is contained in:

Stefan Berger 2024-03-22 10:03:12 -04:00 • committed by Mimi Zohar

parent fec50db703

commit be84f32bb2

2 changed files with 26 additions and 7 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

16

security/integrity/ima/ima_api.c

View file

17

security/integrity/ima/ima_template_lib.c

View file