lkml.org 
[lkml]   [2015]   [May]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.14 83/92] RCU pathwalk breakage when running into a symlink overmounting something
    Date
    3.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Al Viro <viro@zeniv.linux.org.uk>

    commit 3cab989afd8d8d1bc3d99fef0e7ed87c31e7b647 upstream.

    Calling unlazy_walk() in walk_component() and do_last() when we find
    a symlink that needs to be followed doesn't acquire a reference to vfsmount.
    That's fine when the symlink is on the same vfsmount as the parent directory
    (which is almost always the case), but it's not always true - one _can_
    manage to bind a symlink on top of something. And in such cases we end up
    with excessive mntput().

    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/namei.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    --- a/fs/namei.c
    +++ b/fs/namei.c
    @@ -1545,7 +1545,8 @@ static inline int walk_component(struct

    if (should_follow_link(path->dentry, follow)) {
    if (nd->flags & LOOKUP_RCU) {
    - if (unlikely(unlazy_walk(nd, path->dentry))) {
    + if (unlikely(nd->path.mnt != path->mnt ||
    + unlazy_walk(nd, path->dentry))) {
    err = -ECHILD;
    goto out_err;
    }
    @@ -2992,7 +2993,8 @@ finish_lookup:

    if (should_follow_link(path->dentry, !symlink_ok)) {
    if (nd->flags & LOOKUP_RCU) {
    - if (unlikely(unlazy_walk(nd, path->dentry))) {
    + if (unlikely(nd->path.mnt != path->mnt ||
    + unlazy_walk(nd, path->dentry))) {
    error = -ECHILD;
    goto out;
    }



    \
     
     \ /
      Last update: 2015-05-02 22:21    [W:4.028 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site