lkml.org 
[lkml]   [2012]   [Jan]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] fs/ext{3,4}: fix potential race when setversion ioctl updates inode

    The EXT{3,4}_IOC_SETVERSION ioctl() updates the inode without i_mutex,
    this can lead to a race with the other operations that update the same
    inode.

    Patch tested.

    Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
    ---
    fs/ext3/ioctl.c | 6 +++++-
    fs/ext4/ioctl.c | 6 +++++-
    2 files changed, 10 insertions(+), 2 deletions(-)

    diff --git a/fs/ext3/ioctl.c b/fs/ext3/ioctl.c
    index ba1b54e..e7b2ed9 100644
    --- a/fs/ext3/ioctl.c
    +++ b/fs/ext3/ioctl.c
    @@ -134,10 +134,11 @@ flags_out:
    goto setversion_out;
    }

    + mutex_lock(&inode->i_mutex);
    handle = ext3_journal_start(inode, 1);
    if (IS_ERR(handle)) {
    err = PTR_ERR(handle);
    - goto setversion_out;
    + goto unlock_out;
    }
    err = ext3_reserve_inode_write(handle, inode, &iloc);
    if (err == 0) {
    @@ -146,6 +147,9 @@ flags_out:
    err = ext3_mark_iloc_dirty(handle, inode, &iloc);
    }
    ext3_journal_stop(handle);
    +
    +unlock_out:
    + mutex_unlock(&inode->i_mutex);
    setversion_out:
    mnt_drop_write(filp->f_path.mnt);
    return err;
    diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
    index a567968..46a8de6 100644
    --- a/fs/ext4/ioctl.c
    +++ b/fs/ext4/ioctl.c
    @@ -158,10 +158,11 @@ flags_out:
    goto setversion_out;
    }

    + mutex_lock(&inode->i_mutex);
    handle = ext4_journal_start(inode, 1);
    if (IS_ERR(handle)) {
    err = PTR_ERR(handle);
    - goto setversion_out;
    + goto unlock_out;
    }
    err = ext4_reserve_inode_write(handle, inode, &iloc);
    if (err == 0) {
    @@ -170,6 +171,9 @@ flags_out:
    err = ext4_mark_iloc_dirty(handle, inode, &iloc);
    }
    ext4_journal_stop(handle);
    +
    +unlock_out:
    + mutex_unlock(&inode->i_mutex);
    setversion_out:
    mnt_drop_write(filp->f_path.mnt);
    return err;
    --
    1.7.1

    \
     
     \ /
      Last update: 2012-01-03 02:31    [W:0.027 / U:29.816 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site