lkml.org 
[lkml]   [2015]   [Sep]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.4 055/146] RCU pathwalk breakage when running into a symlink overmounting something
    Date
    From: Al Viro <viro@zeniv.linux.org.uk>

    3.4.109-rc1 review patch. If anyone has any objections, please let me know.

    ------------------


    commit 3cab989afd8d8d1bc3d99fef0e7ed87c31e7b647 upstream.

    Calling unlazy_walk() in walk_component() and do_last() when we find
    a symlink that needs to be followed doesn't acquire a reference to vfsmount.
    That's fine when the symlink is on the same vfsmount as the parent directory
    (which is almost always the case), but it's not always true - one _can_
    manage to bind a symlink on top of something. And in such cases we end up
    with excessive mntput().

    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    [lizf: Backported to 3.4: drop the changes to do_last()]
    Signed-off-by: Zefan Li <lizefan@huawei.com>
    ---
    fs/namei.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/fs/namei.c b/fs/namei.c
    index bdcd705..9c4b9b8 100644
    --- a/fs/namei.c
    +++ b/fs/namei.c
    @@ -1314,7 +1314,8 @@ static inline int walk_component(struct nameidata *nd, struct path *path,
    }
    if (should_follow_link(inode, follow)) {
    if (nd->flags & LOOKUP_RCU) {
    - if (unlikely(unlazy_walk(nd, path->dentry))) {
    + if (unlikely(nd->path.mnt != path->mnt ||
    + unlazy_walk(nd, path->dentry))) {
    terminate_walk(nd);
    return -ECHILD;
    }
    --
    1.9.1


    \
     
     \ /
      Last update: 2015-09-15 12:01    [W:4.095 / U:0.248 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site