lkml.org 
[lkml]   [2018]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 121/124] ovl: check whiteout in ovl_create_over_whiteout()
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Miklos Szeredi <mszeredi@redhat.com>

    commit 5e1275808630ea3b2c97c776f40e475017535f72 upstream.

    Kaixuxia repors that it's possible to crash overlayfs by removing the
    whiteout on the upper layer before creating a directory over it. This is a
    reproducer:

    mkdir lower upper work merge
    touch lower/file
    mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge
    rm merge/file
    ls -al merge/file
    rm upper/file
    ls -al merge/
    mkdir merge/file

    Before commencing with a vfs_rename(..., RENAME_EXCHANGE) verify that the
    lookup of "upper" is positive and is a whiteout, and return ESTALE
    otherwise.

    Reported by: kaixuxia <xiakaixu1987@gmail.com>
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
    Fixes: e9be9d5e76e3 ("overlay filesystem")
    Cc: <stable@vger.kernel.org> # v3.18
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/overlayfs/dir.c | 4 ++++
    1 file changed, 4 insertions(+)

    --- a/fs/overlayfs/dir.c
    +++ b/fs/overlayfs/dir.c
    @@ -392,6 +392,10 @@ static int ovl_create_over_whiteout(stru
    if (IS_ERR(upper))
    goto out_dput;

    + err = -ESTALE;
    + if (d_is_negative(upper) || !IS_WHITEOUT(d_inode(upper)))
    + goto out_dput2;
    +
    err = ovl_create_real(wdir, newdentry, cattr, hardlink, true);
    if (err)
    goto out_dput2;

    \
     
     \ /
      Last update: 2018-11-19 19:19    [W:4.108 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site