linux-stable/fs/crypto
Eric Biggers b01531db6c fscrypt: fix race where ->lookup() marks plaintext dentry as ciphertext
->lookup() in an encrypted directory begins as follows:

1. fscrypt_prepare_lookup():
    a. Try to load the directory's encryption key.
    b. If the key is unavailable, mark the dentry as a ciphertext name
       via d_flags.
2. fscrypt_setup_filename():
    a. Try to load the directory's encryption key.
    b. If the key is available, encrypt the name (treated as a plaintext
       name) to get the on-disk name.  Otherwise decode the name
       (treated as a ciphertext name) to get the on-disk name.

But if the key is concurrently added, it may be found at (2a) but not at
(1a).  In this case, the dentry will be wrongly marked as a ciphertext
name even though it was actually treated as plaintext.

This will cause the dentry to be wrongly invalidated on the next lookup,
potentially causing problems.  For example, if the racy ->lookup() was
part of sys_mount(), then the new mount will be detached when anything
tries to access it.  This is despite the mountpoint having a plaintext
path, which should remain valid now that the key was added.

Of course, this is only possible if there's a userspace race.  Still,
the additional kernel-side race is confusing and unexpected.

Close the kernel-side race by changing fscrypt_prepare_lookup() to also
set the on-disk filename (step 2b), consistent with the d_flags update.

Fixes: 28b4c26396 ("ext4 crypto: revalidate dentry after adding or removing the key")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
2019-04-17 10:07:51 -04:00
..
bio.c fscrypt: remove WARN_ON_ONCE() when decryption fails 2019-04-16 18:44:44 -04:00
crypto.c fscrypt: clean up and improve dentry revalidation 2019-04-17 09:48:46 -04:00
fname.c fscrypt: fix race where ->lookup() marks plaintext dentry as ciphertext 2019-04-17 10:07:51 -04:00
fscrypt_private.h fscrypt: remove filesystem specific build config option 2019-01-23 23:56:43 -05:00
hooks.c fscrypt: fix race where ->lookup() marks plaintext dentry as ciphertext 2019-04-17 10:07:51 -04:00
Kconfig fscrypt: remove filesystem specific build config option 2019-01-23 23:56:43 -05:00
keyinfo.c fscrypt: use READ_ONCE() to access ->i_crypt_info 2019-04-16 18:57:09 -04:00
Makefile fscrypt: new helper function - fscrypt_file_open() 2017-10-18 19:52:37 -04:00
policy.c fscrypt: use READ_ONCE() to access ->i_crypt_info 2019-04-16 18:57:09 -04:00