NFSv4: Handle case where the lookup of a directory fails
authorTrond Myklebust <trond.myklebust@hammerspace.com>
Thu, 6 Jan 2022 23:24:02 +0000 (18:24 -0500)
committerSalvatore Bonaccorso <carnil@debian.org>
Mon, 28 Feb 2022 11:23:03 +0000 (11:23 +0000)
commitde656b490f9d708b4a22437192f6206f0a84a501
treeb64b502e57fd7a0e0a12d88c5ebae5685597af16
parent27181a4421eb32febe28a9881cd78c275295dd10
NFSv4: Handle case where the lookup of a directory fails

Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=ce8c552b88ca25d775ecd0a0fbef4e0e03de9ed2
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2022-24448

commit ac795161c93699d600db16c1a8cc23a65a1eceaf upstream.

If the application sets the O_DIRECTORY flag, and tries to open a
regular file, nfs_atomic_open() will punt to doing a regular lookup.
If the server then returns a regular file, we will happily return a
file descriptor with uninitialised open state.

The fix is to return the expected ENOTDIR error in these cases.

Reported-by: Lyu Tao <tao.lyu@epfl.ch>
Fixes: 0dd2b474d0b6 ("nfs: implement i_op->atomic_open()")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Gbp-Pq: Topic bugfix/all
Gbp-Pq: Name NFSv4-Handle-case-where-the-lookup-of-a-directory-fa.patch
fs/nfs/dir.c