From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755482AbdEEDrx (ORCPT ); Thu, 4 May 2017 23:47:53 -0400 Received: from mail-io0-f172.google.com ([209.85.223.172]:34861 "EHLO mail-io0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752803AbdEEDqu (ORCPT ); Thu, 4 May 2017 23:46:50 -0400 MIME-Version: 1.0 In-Reply-To: References: <20170429220414.GT29622@ZenIV.linux.org.uk> <20170505003030.GM29622@ZenIV.linux.org.uk> From: Linus Torvalds Date: Thu, 4 May 2017 20:46:49 -0700 X-Google-Sender-Auth: U_obka8x7YKXO_lDKi1sqw7Y3SA Message-ID: Subject: Re: new ...at() flag: AT_NO_JUMPS To: Jann Horn Cc: Al Viro , Linux API , Linux Kernel Mailing List , linux-fsdevel , David Drysdale Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, May 4, 2017 at 7:47 PM, Jann Horn wrote: > > Thread 1 starts an AT_BENEATH path walk using an O_PATH fd > pointing to /srv/www/example.org/foo; the path given to the syscall is > "bar/../../../../etc/passwd". The path walk enters the "bar" directory. > Thread 2 moves /srv/www/example.org/foo/bar to > /srv/www/example.org/bar. > Thread 1 processes the rest of the path ("../../../../etc/passwd"), never > hitting /srv/www/example.org/foo in the process. > > I'm not really familiar with the VFS internals, but from a coarse look > at the patch, it seems like it wouldn't block this? I think you're right. I guess it would be safe for the RCU case due to the sequence number check, but not the non-RCU case. Al? Linus