From 8373fb5db8c8f4f4a028c39f0c2cf7e95a7fca80 Mon Sep 17 00:00:00 2001 From: Ayush Ranjan Date: Tue, 7 Feb 2023 11:07:08 -0800 Subject: [PATCH] Check hard link target's mount compatibility before kernfs.Dentry cast. Reported-by: syzbot+65dcd89bab032fdb8ac8@syzkaller.appspotmail.com PiperOrigin-RevId: 507832777 --- pkg/sentry/fsimpl/kernfs/filesystem.go | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkg/sentry/fsimpl/kernfs/filesystem.go b/pkg/sentry/fsimpl/kernfs/filesystem.go index 90d05e396..35b88038c 100644 --- a/pkg/sentry/fsimpl/kernfs/filesystem.go +++ b/pkg/sentry/fsimpl/kernfs/filesystem.go @@ -362,8 +362,9 @@ func (fs *Filesystem) LinkAt(ctx context.Context, rp *vfs.ResolvingPath, vd vfs. return err } - parent.dirMu.Lock() - defer parent.dirMu.Unlock() + if rp.Mount() != vd.Mount() { + return linuxerr.EXDEV + } inode := vd.Dentry().Impl().(*Dentry).Inode() if inode.Mode().IsDir() { return linuxerr.EPERM @@ -371,6 +372,8 @@ func (fs *Filesystem) LinkAt(ctx context.Context, rp *vfs.ResolvingPath, vd vfs. if err := vfs.MayLink(rp.Credentials(), inode.Mode(), inode.UID(), inode.GID()); err != nil { return err } + parent.dirMu.Lock() + defer parent.dirMu.Unlock() pc := rp.Component() if err := checkCreateLocked(ctx, rp.Credentials(), pc, parent); err != nil { return err @@ -378,9 +381,6 @@ func (fs *Filesystem) LinkAt(ctx context.Context, rp *vfs.ResolvingPath, vd vfs. if rp.MustBeDir() { return linuxerr.ENOENT } - if rp.Mount() != vd.Mount() { - return linuxerr.EXDEV - } if err := rp.Mount().CheckBeginWrite(); err != nil { return err }