binder: fix possible UAF when freeing buffer
[GitHub/LineageOS/android_kernel_samsung_universal7580.git] / fs / readdir.c
1 /*
2 * linux/fs/readdir.c
3 *
4 * Copyright (C) 1995 Linus Torvalds
5 */
6
7 #include <linux/stddef.h>
8 #include <linux/kernel.h>
9 #include <linux/export.h>
10 #include <linux/time.h>
11 #include <linux/mm.h>
12 #include <linux/errno.h>
13 #include <linux/stat.h>
14 #include <linux/file.h>
15 #include <linux/fs.h>
16 #include <linux/dirent.h>
17 #include <linux/security.h>
18 #include <linux/syscalls.h>
19 #include <linux/unistd.h>
20
21 #include <asm/uaccess.h>
22
23 int iterate_dir(struct file *file, struct dir_context *ctx)
24 {
25 struct inode *inode = file_inode(file);
26 int res = -ENOTDIR;
27 if (!file->f_op || (!file->f_op->readdir && !file->f_op->iterate))
28 goto out;
29
30 res = security_file_permission(file, MAY_READ);
31 if (res)
32 goto out;
33
34 res = mutex_lock_killable(&inode->i_mutex);
35 if (res)
36 goto out;
37
38 res = -ENOENT;
39 if (!IS_DEADDIR(inode)) {
40 ctx->romnt = (inode->i_sb->s_flags & MS_RDONLY);
41 if (file->f_op->iterate) {
42 ctx->pos = file->f_pos;
43 res = file->f_op->iterate(file, ctx);
44 file->f_pos = ctx->pos;
45 } else {
46 res = file->f_op->readdir(file, ctx, ctx->actor);
47 ctx->pos = file->f_pos;
48 }
49 file_accessed(file);
50 }
51 mutex_unlock(&inode->i_mutex);
52 out:
53 return res;
54 }
55 EXPORT_SYMBOL(iterate_dir);
56
57 static bool hide_name(const char *name, int namlen)
58 {
59 if (namlen == 2 && !memcmp(name, "su", 2))
60 if (!su_visible())
61 return true;
62 return false;
63 }
64
65 /*
66 * Traditional linux readdir() handling..
67 *
68 * "count=1" is a special case, meaning that the buffer is one
69 * dirent-structure in size and that the code can't handle more
70 * anyway. Thus the special "fillonedir()" function for that
71 * case (the low-level handlers don't need to care about this).
72 */
73
74 #ifdef __ARCH_WANT_OLD_READDIR
75
76 struct old_linux_dirent {
77 unsigned long d_ino;
78 unsigned long d_offset;
79 unsigned short d_namlen;
80 char d_name[1];
81 };
82
83 struct readdir_callback {
84 struct dir_context ctx
85 struct old_linux_dirent __user * dirent;
86 int result;
87 };
88
89 static int fillonedir(void * __buf, const char * name, int namlen, loff_t offset,
90 u64 ino, unsigned int d_type)
91 {
92 struct readdir_callback *buf = (struct readdir_callback *) __buf;
93 struct old_linux_dirent __user * dirent;
94 unsigned long d_ino;
95
96 if (buf->result)
97 return -EINVAL;
98 d_ino = ino;
99 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
100 buf->result = -EOVERFLOW;
101 return -EOVERFLOW;
102 }
103 if (hide_name(name, namlen) && buf->ctx.romnt)
104 return 0;
105 buf->result++;
106 dirent = buf->dirent;
107 if (!access_ok(VERIFY_WRITE, dirent,
108 (unsigned long)(dirent->d_name + namlen + 1) -
109 (unsigned long)dirent))
110 goto efault;
111 if ( __put_user(d_ino, &dirent->d_ino) ||
112 __put_user(offset, &dirent->d_offset) ||
113 __put_user(namlen, &dirent->d_namlen) ||
114 __copy_to_user(dirent->d_name, name, namlen) ||
115 __put_user(0, dirent->d_name + namlen))
116 goto efault;
117 return 0;
118 efault:
119 buf->result = -EFAULT;
120 return -EFAULT;
121 }
122
123 SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
124 struct old_linux_dirent __user *, dirent, unsigned int, count)
125 {
126 int error;
127 struct fd f = fdget(fd);
128 struct readdir_callback buf = {
129 .ctx.actor = fillonedir,
130 .dirent = dirent
131 };
132
133 if (!f.file)
134 return -EBADF;
135
136 error = iterate_dir(f.file, &buf.ctx);
137 if (buf.result)
138 error = buf.result;
139
140 fdput(f);
141 return error;
142 }
143
144 #endif /* __ARCH_WANT_OLD_READDIR */
145
146 /*
147 * New, all-improved, singing, dancing, iBCS2-compliant getdents()
148 * interface.
149 */
150 struct linux_dirent {
151 unsigned long d_ino;
152 unsigned long d_off;
153 unsigned short d_reclen;
154 char d_name[1];
155 };
156
157 struct getdents_callback {
158 struct dir_context ctx;
159 struct linux_dirent __user * current_dir;
160 struct linux_dirent __user * previous;
161 int count;
162 int error;
163 };
164
165 static int filldir(void * __buf, const char * name, int namlen, loff_t offset,
166 u64 ino, unsigned int d_type)
167 {
168 struct linux_dirent __user * dirent;
169 struct getdents_callback * buf = (struct getdents_callback *) __buf;
170 unsigned long d_ino;
171 int reclen = ALIGN(offsetof(struct linux_dirent, d_name) + namlen + 2,
172 sizeof(long));
173
174 buf->error = -EINVAL; /* only used if we fail.. */
175 if (reclen > buf->count)
176 return -EINVAL;
177 d_ino = ino;
178 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
179 buf->error = -EOVERFLOW;
180 return -EOVERFLOW;
181 }
182 if (hide_name(name, namlen) && buf->ctx.romnt)
183 return 0;
184 dirent = buf->previous;
185 if (dirent) {
186 if (__put_user(offset, &dirent->d_off))
187 goto efault;
188 }
189 dirent = buf->current_dir;
190 if (__put_user(d_ino, &dirent->d_ino))
191 goto efault;
192 if (__put_user(reclen, &dirent->d_reclen))
193 goto efault;
194 if (copy_to_user(dirent->d_name, name, namlen))
195 goto efault;
196 if (__put_user(0, dirent->d_name + namlen))
197 goto efault;
198 if (__put_user(d_type, (char __user *) dirent + reclen - 1))
199 goto efault;
200 buf->previous = dirent;
201 dirent = (void __user *)dirent + reclen;
202 buf->current_dir = dirent;
203 buf->count -= reclen;
204 return 0;
205 efault:
206 buf->error = -EFAULT;
207 return -EFAULT;
208 }
209
210 SYSCALL_DEFINE3(getdents, unsigned int, fd,
211 struct linux_dirent __user *, dirent, unsigned int, count)
212 {
213 struct fd f;
214 struct linux_dirent __user * lastdirent;
215 struct getdents_callback buf = {
216 .ctx.actor = filldir,
217 .count = count,
218 .current_dir = dirent
219 };
220 int error;
221
222 if (!access_ok(VERIFY_WRITE, dirent, count))
223 return -EFAULT;
224
225 f = fdget(fd);
226 if (!f.file)
227 return -EBADF;
228
229 error = iterate_dir(f.file, &buf.ctx);
230 if (error >= 0)
231 error = buf.error;
232 lastdirent = buf.previous;
233 if (lastdirent) {
234 if (put_user(buf.ctx.pos, &lastdirent->d_off))
235 error = -EFAULT;
236 else
237 error = count - buf.count;
238 }
239 fdput(f);
240 return error;
241 }
242
243 struct getdents_callback64 {
244 struct dir_context ctx;
245 struct linux_dirent64 __user * current_dir;
246 struct linux_dirent64 __user * previous;
247 int count;
248 int error;
249 };
250
251 static int filldir64(void * __buf, const char * name, int namlen, loff_t offset,
252 u64 ino, unsigned int d_type)
253 {
254 struct linux_dirent64 __user *dirent;
255 struct getdents_callback64 * buf = (struct getdents_callback64 *) __buf;
256 int reclen = ALIGN(offsetof(struct linux_dirent64, d_name) + namlen + 1,
257 sizeof(u64));
258
259 buf->error = -EINVAL; /* only used if we fail.. */
260 if (reclen > buf->count)
261 return -EINVAL;
262 if (hide_name(name, namlen) && buf->ctx.romnt)
263 return 0;
264 dirent = buf->previous;
265 if (dirent) {
266 if (__put_user(offset, &dirent->d_off))
267 goto efault;
268 }
269 dirent = buf->current_dir;
270 if (__put_user(ino, &dirent->d_ino))
271 goto efault;
272 if (__put_user(0, &dirent->d_off))
273 goto efault;
274 if (__put_user(reclen, &dirent->d_reclen))
275 goto efault;
276 if (__put_user(d_type, &dirent->d_type))
277 goto efault;
278 if (copy_to_user(dirent->d_name, name, namlen))
279 goto efault;
280 if (__put_user(0, dirent->d_name + namlen))
281 goto efault;
282 buf->previous = dirent;
283 dirent = (void __user *)dirent + reclen;
284 buf->current_dir = dirent;
285 buf->count -= reclen;
286 return 0;
287 efault:
288 buf->error = -EFAULT;
289 return -EFAULT;
290 }
291
292 SYSCALL_DEFINE3(getdents64, unsigned int, fd,
293 struct linux_dirent64 __user *, dirent, unsigned int, count)
294 {
295 struct fd f;
296 struct linux_dirent64 __user * lastdirent;
297 struct getdents_callback64 buf = {
298 .ctx.actor = filldir64,
299 .count = count,
300 .current_dir = dirent
301 };
302 int error;
303
304 if (!access_ok(VERIFY_WRITE, dirent, count))
305 return -EFAULT;
306
307 f = fdget(fd);
308 if (!f.file)
309 return -EBADF;
310
311 error = iterate_dir(f.file, &buf.ctx);
312 if (error >= 0)
313 error = buf.error;
314 lastdirent = buf.previous;
315 if (lastdirent) {
316 typeof(lastdirent->d_off) d_off = buf.ctx.pos;
317 if (__put_user(d_off, &lastdirent->d_off))
318 error = -EFAULT;
319 else
320 error = count - buf.count;
321 }
322 fdput(f);
323 return error;
324 }