fscrypt: fix race allowing rename() and link() of ciphertext dentries

commit 968dd6d0c6d6b6a989c6ddb9e2584a031b83e7b5 upstream.

Close some race conditions where fscrypt allowed rename() and link() on
ciphertext dentries that had been looked up just prior to the key being
concurrently added.  It's better to return -ENOKEY in this case.

This avoids doing the nonsensical thing of encrypting the names a second
time when searching for the actual on-disk dir entries.  It also
guarantees that DCACHE_ENCRYPTED_NAME dentries are never rename()d, so
the dcache won't have support all possible combinations of moving
DCACHE_ENCRYPTED_NAME around during __d_move().

Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/crypto/hooks.c b/fs/crypto/hooks.c
index a9492f75bbe13ffee7c14f69c4d8120ad049116a..2e7498a821a487c83177d0290645521ff66d7126 100644 (file)
--- a/fs/crypto/hooks.c
+++ b/fs/crypto/hooks.c
@@ -49,7 +49,8 @@ int fscrypt_file_open(struct inode *inode, struct file *filp)
 }
 EXPORT_SYMBOL_GPL(fscrypt_file_open);
 
-int __fscrypt_prepare_link(struct inode *inode, struct inode *dir)
+int __fscrypt_prepare_link(struct inode *inode, struct inode *dir,
+                          struct dentry *dentry)
 {
        int err;
 
@@ -57,6 +58,10 @@ int __fscrypt_prepare_link(struct inode *inode, struct inode *dir)
        if (err)
                return err;
 
+       /* ... in case we looked up ciphertext name before key was added */
+       if (dentry->d_flags & DCACHE_ENCRYPTED_NAME)
+               return -ENOKEY;
+
        if (!fscrypt_has_permitted_context(dir, inode))
                return -EXDEV;
 
@@ -78,6 +83,11 @@ int __fscrypt_prepare_rename(struct inode *old_dir, struct dentry *old_dentry,
        if (err)
                return err;
 
+       /* ... in case we looked up ciphertext name(s) before key was added */
+       if ((old_dentry->d_flags | new_dentry->d_flags) &
+           DCACHE_ENCRYPTED_NAME)
+               return -ENOKEY;
+
        if (old_dir != new_dir) {
                if (IS_ENCRYPTED(new_dir) &&
                    !fscrypt_has_permitted_context(new_dir,

diff --git a/include/linux/fscrypt.h b/include/linux/fscrypt.h
index c83e4dc55c0629b84d549a93ea86265ebe7f02f8..af52a240c7399f51b6e9b16cc5c32a9175590d79 100644 (file)
--- a/include/linux/fscrypt.h
+++ b/include/linux/fscrypt.h
@@ -97,7 +97,7 @@ static inline int fscrypt_prepare_link(struct dentry *old_dentry,
                                       struct dentry *dentry)
 {
        if (IS_ENCRYPTED(dir))
-               return __fscrypt_prepare_link(d_inode(old_dentry), dir);
+               return __fscrypt_prepare_link(d_inode(old_dentry), dir, dentry);
        return 0;
 }
 

diff --git a/include/linux/fscrypt_notsupp.h b/include/linux/fscrypt_notsupp.h
index ee8b43e4c15a615bbddc93e8869668eba100f1b9..15bbbd7c52b8bed04331e0e0166ff2681323d3a1 100644 (file)
--- a/include/linux/fscrypt_notsupp.h
+++ b/include/linux/fscrypt_notsupp.h
@@ -183,8 +183,8 @@ static inline int fscrypt_file_open(struct inode *inode, struct file *filp)
        return 0;
 }
 
-static inline int __fscrypt_prepare_link(struct inode *inode,
-                                        struct inode *dir)
+static inline int __fscrypt_prepare_link(struct inode *inode, struct inode *dir,
+                                        struct dentry *dentry)
 {
        return -EOPNOTSUPP;
 }

diff --git a/include/linux/fscrypt_supp.h b/include/linux/fscrypt_supp.h
index 6456c6b2005f498a56c2b60cd510e15a823ddb6c..b8443a2e47dc4fade658f4807c83c2cbb74fc649 100644 (file)
--- a/include/linux/fscrypt_supp.h
+++ b/include/linux/fscrypt_supp.h
@@ -184,7 +184,8 @@ extern int fscrypt_zeroout_range(const struct inode *, pgoff_t, sector_t,
 
 /* hooks.c */
 extern int fscrypt_file_open(struct inode *inode, struct file *filp);
-extern int __fscrypt_prepare_link(struct inode *inode, struct inode *dir);
+extern int __fscrypt_prepare_link(struct inode *inode, struct inode *dir,
+                                 struct dentry *dentry);
 extern int __fscrypt_prepare_rename(struct inode *old_dir,
                                    struct dentry *old_dentry,
                                    struct inode *new_dir,