svn commit: r366549 - head/sys/kern

[Konstantin Belousov]

Author: kib
Date: Thu Oct  8 22:31:11 2020
New Revision: 366549
URL: https://svnweb.freebsd.org/changeset/base/366549

Log:
  Do not allow to use O_BENEATH as an oracle.
  
  Specifically, if lookup() returned any error and the topping directory
  was not latched, which means that (non-existent) path did not returned
  to the topping location, give ENOTCAPABLE a priority over the lookup()
  error.
  
  PR:	249960
  Reviewed by:	emaste, ngie
  Sponsored by:	The FreeBSD Foundation
  MFC after:	1 week
  Differential revision:	https://reviews.freebsd.org/D26695

Modified:
  head/sys/kern/vfs_lookup.c

Modified: head/sys/kern/vfs_lookup.c
==============================================================================
--- head/sys/kern/vfs_lookup.c	Thu Oct  8 22:00:31 2020	(r366548)
+++ head/sys/kern/vfs_lookup.c	Thu Oct  8 22:31:11 2020	(r366549)
@@ -595,8 +595,17 @@ namei(struct nameidata *ndp)
 	for (;;) {
 		ndp->ni_startdir = dp;
 		error = lookup(ndp);
-		if (error != 0)
+		if (error != 0) {
+			/*
+			 * Override an error to not allow user to use
+			 * BENEATH as an oracle.
+			 */
+			if ((ndp->ni_lcf & (NI_LCF_LATCH |
+			    NI_LCF_BENEATH_LATCHED)) == NI_LCF_LATCH)
+				error = ENOTCAPABLE;
 			goto out;
+		}
+
 		/*
 		 * If not a symbolic link, we're done.
 		 */