mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
Davide OrnaghiandSteve French
1c8951963d
The SMB2 open lookup is rooted at the share with LOOKUP_BENEATH, but the
create/mkdir/hardlink sink is not: ksmbd_vfs_kern_path_create() builds an
absolute path with convert_to_unix_name() and resolves it from AT_FDCWD
via start_creating_path(), so a ".." component is walked from the real
filesystem root and escapes the export.
An authenticated client races a missing path component so the rooted open
lookup returns -ENOENT (taking the create branch) while the same component
is present (a directory) when the create walk runs; the create then
resolves ".." out of the share.
Root the create walk at the share like the lookup and rename paths already
are: resolve the parent with vfs_path_parent_lookup(..., LOOKUP_BENEATH,
&share_conf->vfs_path) and create the final component with
start_creating_noperm(). convert_to_unix_name() then has no callers and is
removed.
Fixes: 265fd1991c ("ksmbd: use LOOKUP_BENEATH to prevent the out of share access")
Cc: stable@vger.kernel.org
Signed-off-by: Davide Ornaghi <d.ornaghi97@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
67 lines
2.0 KiB
C
67 lines
2.0 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/*
|
|
* Copyright (C) 2018 Samsung Electronics Co., Ltd.
|
|
*/
|
|
|
|
#ifndef __KSMBD_MISC_H__
|
|
#define __KSMBD_MISC_H__
|
|
|
|
#ifdef CONFIG_PROC_FS
|
|
#include <linux/proc_fs.h>
|
|
#endif
|
|
struct ksmbd_share_config;
|
|
struct nls_table;
|
|
struct kstat;
|
|
struct ksmbd_file;
|
|
|
|
int match_pattern(const char *str, size_t len, const char *pattern);
|
|
int ksmbd_validate_filename(char *filename);
|
|
int parse_stream_name(char *filename, char **stream_name, int *s_type);
|
|
char *convert_to_nt_pathname(struct ksmbd_share_config *share,
|
|
const struct path *path);
|
|
int get_nlink(struct kstat *st);
|
|
void ksmbd_conv_path_to_unix(char *path);
|
|
void ksmbd_strip_last_slash(char *path);
|
|
void ksmbd_conv_path_to_windows(char *path);
|
|
char *ksmbd_casefold_sharename(struct unicode_map *um, const char *name);
|
|
char *ksmbd_extract_sharename(struct unicode_map *um, const char *treename);
|
|
|
|
#define KSMBD_DIR_INFO_ALIGNMENT 8
|
|
struct ksmbd_dir_info;
|
|
char *ksmbd_convert_dir_info_name(struct ksmbd_dir_info *d_info,
|
|
const struct nls_table *local_nls,
|
|
int *conv_len);
|
|
|
|
#define NTFS_TIME_OFFSET ((u64)(369 * 365 + 89) * 24 * 3600 * 10000000)
|
|
struct timespec64 ksmbd_NTtimeToUnix(__le64 ntutc);
|
|
u64 ksmbd_UnixTimeToNT(struct timespec64 t);
|
|
long long ksmbd_systime(void);
|
|
|
|
#ifdef CONFIG_PROC_FS
|
|
struct ksmbd_const_name {
|
|
unsigned int const_value;
|
|
const char *name;
|
|
};
|
|
|
|
void ksmbd_proc_init(void);
|
|
void ksmbd_proc_cleanup(void);
|
|
void ksmbd_proc_reset(void);
|
|
struct proc_dir_entry *ksmbd_proc_create(const char *name,
|
|
int (*show)(struct seq_file *m, void *v),
|
|
void *v);
|
|
void ksmbd_proc_show_flag_names(struct seq_file *m,
|
|
const struct ksmbd_const_name *table,
|
|
int count,
|
|
unsigned int flags);
|
|
void ksmbd_proc_show_const_name(struct seq_file *m,
|
|
const char *format,
|
|
const struct ksmbd_const_name *table,
|
|
int count,
|
|
unsigned int const_value);
|
|
#else
|
|
static inline void ksmbd_proc_init(void) {}
|
|
static inline void ksmbd_proc_cleanup(void) {}
|
|
static inline void ksmbd_proc_reset(void) {}
|
|
#endif
|
|
#endif /* __KSMBD_MISC_H__ */
|