TOMOYO: Fix oops in tomoyo_mount_acl().
In tomoyo_mount_acl() since 2.6.36, kern_path() was called without checking dev_name != NULL. As a result, an unprivileged user can trigger oops by issuing mount(NULL, "/", "ext3", 0, NULL) request. Fix this by checking dev_name != NULL before calling kern_path(dev_name). Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Cc: stable@kernel.org Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
parent
2c53b436a3
commit
4e78c724d4
|
@ -138,7 +138,7 @@ static int tomoyo_mount_acl(struct tomoyo_request_info *r, char *dev_name,
|
|||
}
|
||||
if (need_dev) {
|
||||
/* Get mount point or device file. */
|
||||
if (kern_path(dev_name, LOOKUP_FOLLOW, &path)) {
|
||||
if (!dev_name || kern_path(dev_name, LOOKUP_FOLLOW, &path)) {
|
||||
error = -ENOENT;
|
||||
goto out;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue