kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/fs/cachefiles
History
Al Viro 45d8e6c921 cachefiles: fix the race between cachefiles_bury_object() and rmdir(2) 
commit 169b803397 upstream.

the victim might've been rmdir'ed just before the lock_rename();
unlike the normal callers, we do not look the source up after the
parents are locked - we know it beforehand and just recheck that it's
still the child of what used to be its parent.  Unfortunately,
the check is too weak - we don't spot a dead directory since its
->d_parent is unchanged, dentry is positive, etc.  So we sail all
the way to ->rename(), with hosting filesystems _not_ expecting
to be asked renaming an rmdir'ed subdirectory.

The fix is easy, fortunately - the lock on parent is sufficient for
making IS_DEADDIR() on child safe.

Fixes: 9ae326a690 (CacheFiles: A cache that backs onto a mounted filesystem)
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-12-16 22:09:43 +00:00
..
bind.c fscache: Fix reference overput in fscache_attach_object() error handling 2018-11-20 18:05:49 +00:00
daemon.c fs/cachefiles: add missing \n to kerror conversions 2014-10-05 13:41:07 -07:00
interface.c fs/cachefiles: replace kerror by pr_err 2014-06-06 16:08:14 -07:00
internal.h fs/cachefiles: add missing \n to kerror conversions 2014-10-05 13:41:07 -07:00
Kconfig CacheFiles: A cache that backs onto a mounted filesystem 2009-04-03 16:42:41 +01:00
key.c CacheFiles: Downgrade the requirements passed to the allocator 2012-12-20 21:58:25 +00:00
main.c fs/cachefiles: add missing \n to kerror conversions 2014-10-05 13:41:07 -07:00
Makefile CacheFiles: A cache that backs onto a mounted filesystem 2009-04-03 16:42:41 +01:00
namei.c cachefiles: fix the race between cachefiles_bury_object() and rmdir(2) 2018-12-16 22:09:43 +00:00
proc.c CacheFiles: A cache that backs onto a mounted filesystem 2009-04-03 16:42:41 +01:00
rdwr.c cachefiles: Fix refcounting bug in backing-file read monitoring 2018-11-20 18:05:49 +00:00
security.c fs/cachefiles: replace kerror by pr_err 2014-06-06 16:08:14 -07:00
xattr.c fs/cachefiles: add missing \n to kerror conversions 2014-10-05 13:41:07 -07:00