mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
51 lines
1.9 KiB
Diff
51 lines
1.9 KiB
Diff
|
From 9f7d53c09a1f87ebe228b55a83c1b8f952d76260 Mon Sep 17 00:00:00 2001
|
||
|
|
From: "Eric W. Biederman" <ebiederm@xmission.com>
|
||
|
|
Date: Wed, 8 Oct 2014 10:42:27 -0700
|
||
|
|
Subject: mnt: Prevent pivot_root from creating a loop in the mount tree
|
||
|
|
|
||
|
|
commit 0d0826019e529f21c84687521d03f60cd241ca7d upstream.
|
||
|
|
|
||
|
|
Andy Lutomirski recently demonstrated that when chroot is used to set
|
||
|
|
the root path below the path for the new ``root'' passed to pivot_root
|
||
|
|
the pivot_root system call succeeds and leaks mounts.
|
||
|
|
|
||
|
|
In examining the code I see that starting with a new root that is
|
||
|
|
below the current root in the mount tree will result in a loop in the
|
||
|
|
mount tree after the mounts are detached and then reattached to one
|
||
|
|
another. Resulting in all kinds of ugliness including a leak of that
|
||
|
|
mounts involved in the leak of the mount loop.
|
||
|
|
|
||
|
|
Prevent this problem by ensuring that the new mount is reachable from
|
||
|
|
the current root of the mount tree.
|
||
|
|
|
||
|
|
[Added stable cc. Fixes CVE-2014-7970. --Andy]
|
||
|
|
|
||
|
|
Reported-by: Andy Lutomirski <luto@amacapital.net>
|
||
|
|
Reviewed-by: Andy Lutomirski <luto@amacapital.net>
|
||
|
|
Link: http://lkml.kernel.org/r/87bnpmihks.fsf@x220.int.ebiederm.org
|
||
|
|
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
|
||
|
|
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
|
||
|
|
[lizf: Backported to 3.4: adjust context]
|
||
|
|
Signed-off-by: Zefan Li <lizefan@huawei.com>
|
||
|
|
---
|
||
|
|
fs/namespace.c | 3 +++
|
||
|
|
1 file changed, 3 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/fs/namespace.c b/fs/namespace.c
|
||
|
|
index f0f2e06..f7be8d9 100644
|
||
|
|
--- a/fs/namespace.c
|
||
|
|
+++ b/fs/namespace.c
|
||
|
|
@@ -2508,6 +2508,9 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
|
||
|
|
/* make sure we can reach put_old from new_root */
|
||
|
|
if (!is_path_reachable(real_mount(old.mnt), old.dentry, &new))
|
||
|
|
goto out4;
|
||
|
|
+ /* make certain new is below the root */
|
||
|
|
+ if (!is_path_reachable(new_mnt, new.dentry, &root))
|
||
|
|
+ goto out4;
|
||
|
|
br_write_lock(vfsmount_lock);
|
||
|
|
detach_mnt(new_mnt, &parent_path);
|
||
|
|
detach_mnt(root_mnt, &root_parent);
|
||
|
|
--
|
||
|
|
cgit v1.1
|
||
|
|
|