diff options
author | Al Viro <viro@zeniv.linux.org.uk> | 2023-11-20 20:02:11 -0500 |
---|---|---|
committer | Al Viro <viro@zeniv.linux.org.uk> | 2023-11-25 02:54:14 -0500 |
commit | a8b0026847b8c43445c921ad2c85521c92eb175f (patch) | |
tree | 39078ede8594fab57ee0486e522655df86cb131f /fs/overlayfs/dir.c | |
parent | kill lock_two_inodes() (diff) | |
download | wireguard-linux-a8b0026847b8c43445c921ad2c85521c92eb175f.tar.xz wireguard-linux-a8b0026847b8c43445c921ad2c85521c92eb175f.zip |
rename(): avoid a deadlock in the case of parents having no common ancestor
... and fix the directory locking documentation and proof of correctness.
Holding ->s_vfs_rename_mutex *almost* prevents ->d_parent changes; the
case where we really don't want it is splicing the root of disconnected
tree to somewhere.
In other words, ->s_vfs_rename_mutex is sufficient to stabilize "X is an
ancestor of Y" only if X and Y are already in the same tree. Otherwise
it can go from false to true, and one can construct a deadlock on that.
Make lock_two_directories() report an error in such case and update the
callers of lock_rename()/lock_rename_child() to handle such errors.
And yes, such conditions are not impossible to create ;-/
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs/overlayfs/dir.c')
-rw-r--r-- | fs/overlayfs/dir.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c index aab3f5d93556..0f8b4a719237 100644 --- a/fs/overlayfs/dir.c +++ b/fs/overlayfs/dir.c @@ -1180,6 +1180,10 @@ static int ovl_rename(struct mnt_idmap *idmap, struct inode *olddir, } trap = lock_rename(new_upperdir, old_upperdir); + if (IS_ERR(trap)) { + err = PTR_ERR(trap); + goto out_revert_creds; + } olddentry = ovl_lookup_upper(ofs, old->d_name.name, old_upperdir, old->d_name.len); |