From 49c98a4bf3a87ace0df99056fa683805c1645e61 Mon Sep 17 00:00:00 2001 From: Konstantin Belousov Date: Sun, 28 Feb 2021 02:15:21 +0200 Subject: nameicap_check_dotdot: trim tracker on check Tracker should contain exactly the path from the starting directory to the current lookup point. Otherwise we might not detect some cases of dotdot escape. Consequently, if we are walking up the tree by dotdot lookup, we must remove an entries below the walked directory. Reviewed by: markj Tested by: arichardson, pho Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D28907 --- sys/kern/vfs_lookup.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'sys/kern/vfs_lookup.c') diff --git a/sys/kern/vfs_lookup.c b/sys/kern/vfs_lookup.c index abc01c73e24c..b4280f85c5b6 100644 --- a/sys/kern/vfs_lookup.c +++ b/sys/kern/vfs_lookup.c @@ -240,8 +240,12 @@ nameicap_check_dotdot(struct nameidata *ndp, struct vnode *dp) return (ENOTCAPABLE); TAILQ_FOREACH_REVERSE(nt, &ndp->ni_cap_tracker, nameicap_tracker_head, nm_link) { - if (dp == nt->dp) + if (dp == nt->dp) { + nt = TAILQ_NEXT(nt, nm_link); + if (nt != NULL) + nameicap_cleanup_from(ndp, nt); return (0); + } } return (ENOTCAPABLE); } -- cgit v1.2.3