shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-03-24 19:40:21 +09:00
Code Issues Packages Projects Releases Wiki Activity

ANDROID: sdcardfs: Change current->fs under lock

Browse Source 
PD#SWPL-5666

Problem:
STS test fail
testPocCVE_2018_9515

Solution:
bug: 111641492 from security

Verify:
U212

Change-Id: I79e9894f94880048edaf0f7cfa2d180f65cbcf3b
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Daniel Rosenberg <drosen@google.com>
This commit is contained in:
Daniel Rosenberg
2018-07-20 16:11:40 -07:00
committed by Luke Go
parent c5536d6d81
commit dc2f2aa319
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
fs/sdcardfs/inode.c
View File

@@ -95,8 +95,10 @@ static int sdcardfs_create(struct inode *dir, struct dentry *dentry,
err = -ENOMEM;
goto out_unlock;
}
copied_fs->umask = 0;
task_lock(current);
current->fs = copied_fs;
current->fs->umask = 0;
task_unlock(current);
err = vfs_create2(lower_dentry_mnt, d_inode(lower_parent_dentry), lower_dentry, mode, want_excl);
if (err)
goto out;
@@ -110,7 +112,9 @@ static int sdcardfs_create(struct inode *dir, struct dentry *dentry,
fixup_lower_ownership(dentry, dentry->d_name.name);
out:
task_lock(current);
current->fs = saved_fs;
task_unlock(current);
free_fs_struct(copied_fs);
out_unlock:
unlock_dir(lower_parent_dentry);
@@ -316,8 +320,10 @@ static int sdcardfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
unlock_dir(lower_parent_dentry);
goto out_unlock;
}
copied_fs->umask = 0;
task_lock(current);
current->fs = copied_fs;
current->fs->umask = 0;
task_unlock(current);
err = vfs_mkdir2(lower_mnt, d_inode(lower_parent_dentry), lower_dentry, mode);
if (err) {
@@ -377,7 +383,10 @@ static int sdcardfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
}
}
out:
task_lock(current);
current->fs = saved_fs;
task_unlock(current);
free_fs_struct(copied_fs);
out_unlock:
sdcardfs_put_lower_path(dentry, &lower_path);