lkml.org 
[lkml]   [2021]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.14 025/151] ovl: fix missing negative dentry check in ovl_rename()
    Date
    From: Zheng Liang <zhengliang6@huawei.com>

    commit a295aef603e109a47af355477326bd41151765b6 upstream.

    The following reproducer

    mkdir lower upper work merge
    touch lower/old
    touch lower/new
    mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge
    rm merge/new
    mv merge/old merge/new & unlink upper/new

    may result in this race:

    PROCESS A:
    rename("merge/old", "merge/new");
    overwrite=true,ovl_lower_positive(old)=true,
    ovl_dentry_is_whiteout(new)=true -> flags |= RENAME_EXCHANGE

    PROCESS B:
    unlink("upper/new");

    PROCESS A:
    lookup newdentry in new_upperdir
    call vfs_rename() with negative newdentry and RENAME_EXCHANGE

    Fix by adding the missing check for negative newdentry.

    Signed-off-by: Zheng Liang <zhengliang6@huawei.com>
    Fixes: e9be9d5e76e3 ("overlay filesystem")
    Cc: <stable@vger.kernel.org> # v3.18
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/overlayfs/dir.c | 10 +++++++---
    1 file changed, 7 insertions(+), 3 deletions(-)

    --- a/fs/overlayfs/dir.c
    +++ b/fs/overlayfs/dir.c
    @@ -1215,9 +1215,13 @@ static int ovl_rename(struct user_namesp
    goto out_dput;
    }
    } else {
    - if (!d_is_negative(newdentry) &&
    - (!new_opaque || !ovl_is_whiteout(newdentry)))
    - goto out_dput;
    + if (!d_is_negative(newdentry)) {
    + if (!new_opaque || !ovl_is_whiteout(newdentry))
    + goto out_dput;
    + } else {
    + if (flags & RENAME_EXCHANGE)
    + goto out_dput;
    + }
    }

    if (olddentry == trap)

    \
     
     \ /
      Last update: 2021-10-11 16:01    [W:4.045 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site