Baokun Li 4b4391e77a cachefiles: defer exposing anon_fd until after copy_to_user() succeeds ... After installing the anonymous fd, we can now see it in userland and close it. However, at this point we may not have gotten the reference count of the cache, but we will put it during colse fd, so this may cause a cache UAF. So grab the cache reference count before fd_install(). In addition, by kernel convention, fd is taken over by the user land after fd_install(), and the kernel should not call close_fd() after that, i.e., it should call fd_install() after everything is ready, thus fd_install() is called after copy_to_user() succeeds. Fixes: c838305450 ("cachefiles: notify the user daemon when looking up cookie") Suggested-by: Hou Tao <houtao1@huawei.com> Signed-off-by: Baokun Li <libaokun1@huawei.com> Link: https://lore.kernel.org/r/20240522114308.2402121-10-libaokun@huaweicloud.com Acked-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Christian Brauner <brauner@kernel.org>		2024-05-29 13:03:30 +02:00
..
cache.c	cachefiles: fix memory leak in cachefiles_add_cache()	2024-02-20 09:46:07 +01:00
daemon.c	cachefiles: remove requests from xarray during flushing requests	2024-05-29 13:03:29 +02:00
error_inject.c	cachefiles: Remove the now superfluous sentinel element from ctl_table array	2023-12-28 04:57:57 -08:00
interface.c	cachefiles: extract ondemand info field from cachefiles_object	2023-11-25 16:03:57 +01:00
internal.h	cachefiles: add spin_lock for cachefiles_ondemand_info	2024-05-29 13:03:30 +02:00
io.c	vfs-6.8.netfs	2024-01-19 09:10:23 -08:00
Kconfig	netfs, fscache: Combine fscache with netfs	2023-12-24 15:08:46 +00:00
key.c	cachefiles: Implement key to filename encoding	2022-01-07 13:42:16 +00:00
main.c	cachefiles: Implement object lifecycle funcs	2022-01-07 13:42:08 +00:00
Makefile	cachefiles: notify the user daemon when looking up cookie	2022-05-18 00:11:17 +08:00
namei.c	rename(): avoid a deadlock in the case of parents having no common ancestor	2023-11-25 02:54:14 -05:00
ondemand.c	cachefiles: defer exposing anon_fd until after copy_to_user() succeeds	2024-05-29 13:03:30 +02:00
security.c	cachefiles: Add security derivation	2022-01-07 13:41:14 +00:00
volume.c	fscache, cachefiles: Store the volume coherency data	2022-01-07 13:43:03 +00:00
xattr.c	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00