Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 59430262 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

vfs: fix race in rcu lookup of pruned dentry 



Don't update *inode in __follow_mount_rcu() until we'd verified that
there is mountpoint there.  Kudos to Hugh Dickins for catching that
one in the first place and eventually figuring out the solution (and
catching a braino in the earlier version of patch).

Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent fec11dd9

fs/namei.c

+6 −1
Original line number Original line Diff line number Diff line
@@ -942,7 +942,6 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, 
		 * Don't forget we might have a non-mountpoint managed dentry

		 * Don't forget we might have a non-mountpoint managed dentry

		 * that wants to block transit.

		 * that wants to block transit.

		 */

		 */

		*inode = path->dentry->d_inode;

		if (unlikely(managed_dentry_might_block(path->dentry)))

		if (unlikely(managed_dentry_might_block(path->dentry)))

			return false;

			return false;
@@ -955,6 +954,12 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path, 
		path->mnt = mounted;

		path->mnt = mounted;

		path->dentry = mounted->mnt_root;

		path->dentry = mounted->mnt_root;

		nd->seq = read_seqcount_begin(&path->dentry->d_seq);

		nd->seq = read_seqcount_begin(&path->dentry->d_seq);

		/*

		 * Update the inode too. We don't need to re-check the

		 * dentry sequence number here after this d_inode read,

		 * because a mount-point is always pinned.

		 */

		*inode = path->dentry->d_inode;

	}

	}

	return true;

	return true;

}

}