The branch main has been updated by kib:
URL:
https://cgit.FreeBSD.org/src/commit/?id=49c98a4bf3a87ace0df99056fa683805c1645e61
commit 49c98a4bf3a87ace0df99056fa683805c1645e61
Author: Konstantin Belousov <k...@freebsd.org>
AuthorDate: 2021-02-28 00:15:21 +0000
Commit: Konstantin Belousov <k...@freebsd.org>
CommitDate: 2021-03-02 18:21:35 +0000
nameicap_check_dotdot: trim tracker on check
Tracker should contain exactly the path from the starting directory to
the current lookup point. Otherwise we might not detect some cases of
dotdot escape. Consequently, if we are walking up the tree by dotdot
lookup, we must remove an entries below the walked directory.
Reviewed by: markj
Tested by: arichardson, pho
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D28907
---
sys/kern/vfs_lookup.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/sys/kern/vfs_lookup.c b/sys/kern/vfs_lookup.c
index abc01c73e24c..b4280f85c5b6 100644
--- a/sys/kern/vfs_lookup.c
+++ b/sys/kern/vfs_lookup.c
@@ -240,8 +240,12 @@ nameicap_check_dotdot(struct nameidata *ndp, struct vnode
*dp)
return (ENOTCAPABLE);
TAILQ_FOREACH_REVERSE(nt, &ndp->ni_cap_tracker, nameicap_tracker_head,
nm_link) {
- if (dp == nt->dp)
+ if (dp == nt->dp) {
+ nt = TAILQ_NEXT(nt, nm_link);
+ if (nt != NULL)
+ nameicap_cleanup_from(ndp, nt);
return (0);
+ }
}
return (ENOTCAPABLE);
}
_______________________________________________
dev-commits-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/dev-commits-src-all
To unsubscribe, send any mail to "dev-commits-src-all-unsubscr...@freebsd.org"
