From patchwork Tue May 15 10:26:12 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amir Goldstein X-Patchwork-Id: 10400805 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5F323601D2 for ; Tue, 15 May 2018 10:25:11 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4942E28734 for ; Tue, 15 May 2018 10:25:11 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3D99B2872E; Tue, 15 May 2018 10:25:11 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BF96C2872E for ; Tue, 15 May 2018 10:25:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752717AbeEOKZI (ORCPT ); Tue, 15 May 2018 06:25:08 -0400 Received: from mail-wm0-f67.google.com ([74.125.82.67]:55146 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752691AbeEOKZE (ORCPT ); Tue, 15 May 2018 06:25:04 -0400 Received: by mail-wm0-f67.google.com with SMTP id f6-v6so34821wmc.4; Tue, 15 May 2018 03:25:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=aT+9kGpmtRWdCr88HctoyJaoq9w2ITkc+orFUqsjJ0s=; b=Ah9JkiCP6evdcB0ScRybMh0LC4PsKT8HMqQn6gycLMsTWWDIAL+0I3JZvzY3YWDq6w Nl4LDt9LYQpPqyuBrEOC948fHm2pX6oRsfgOB00P4q+vRT4YCNZI0WPyk0n23A5zpGu4 q+Xr1dfvOEpPtpJrlMafvx6k++XZUAEn6NTRPz9TKGUGZ6na0zIE3ZyCdNtpbu2HHuDv BRMeIxOsTNCzkMRd4AV9J4imIF43CVI/F3OMyAh+My+RQyiit79Ffm6y6R6MsjDAn4z2 FhCgBppcOr+61/h2mqBYrU+u8eqa4Lb+XCM1Yp6/5xqFhw9JPORWUQa1YYE21/stvESy +Fmw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=aT+9kGpmtRWdCr88HctoyJaoq9w2ITkc+orFUqsjJ0s=; b=XXZ2JSAPxb2jxWlSHTRMPM2MpNAEtzaaFMhDg3vJTdnY10riLXbIvM9GOo0exjm+Xn 8/K1czx7vbYFFeFFwjjy7MXnXu/WVancpThb1kxa+fBrg/7ZyROfX6xvklz/yQ0cTVSP O3EFuWZVeCaJch4AV/7dH/2g2MqrhbX34CuYwU/YfLMog/pUcFTh1JojbSeudT5OJETQ u4K/is5PmA0AN/vgJnnHWIhBsJ6GHXSfVNlen2q8Pfp93foGIiMqK+EhVIDN+JnXOysl bEuGZQhYf0LaSH07NsGyTSe25M+pnixRoZkhNOtE/VCo3ebtiKdpZzVl9LUcrBXQdmSo wFPg== X-Gm-Message-State: ALKqPwd4aGC3ZMQzr7DgsCjjKIjqtTf4cOHAfm5GelqvniUnhr6XXz4P L2RWyqhqXqN2nK/ezDUhyDM= X-Google-Smtp-Source: AB8JxZpAbn1pZOP52aV5lGo4ZYi6lH5/1UzOGtjE2Zc0Dmitblr4uAcHOBVYy4/lnGEIl4iCwyZ8uQ== X-Received: by 2002:a50:b0c3:: with SMTP id j61-v6mr16884547edd.249.1526379902661; Tue, 15 May 2018 03:25:02 -0700 (PDT) Received: from amir-VirtualBox.ctera.local (bzq-166-168-31-246.red.bezeqint.net. [31.168.166.246]) by smtp.gmail.com with ESMTPSA id v22-v6sm10039edq.15.2018.05.15.03.25.01 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 15 May 2018 03:25:02 -0700 (PDT) From: Amir Goldstein To: Miklos Szeredi Cc: Al Viro , Vivek Goyal , linux-unionfs@vger.kernel.org, linux-fsdevel@vger.kernel.org Subject: [PATCH v3 4/4] ovl: make ovl_create_real() cope with vfs_mkdir() safely Date: Tue, 15 May 2018 13:26:12 +0300 Message-Id: <1526379972-20923-5-git-send-email-amir73il@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1526379972-20923-1-git-send-email-amir73il@gmail.com> References: <1526379972-20923-1-git-send-email-amir73il@gmail.com> Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Al Viro vfs_mkdir() may succeed and leave the dentry passed to it unhashed and negative. ovl_create_real() is the last caller breaking when that happens. Pass newdentry to ovl_create_real() by ref, so in the case above, if lookup finds a good dentry, newdentry will be replaced by the positive hashed one. [amir: split re-factoring to prep patch pass dentry by ref factor out helper ovl_create_real_dir() add pr_warn() if mkdir succeeds and lookup fails] Signed-off-by: Al Viro Signed-off-by: Amir Goldstein --- fs/overlayfs/dir.c | 42 +++++++++++++++++++++++++++++++++++++----- fs/overlayfs/overlayfs.h | 2 +- fs/overlayfs/super.c | 2 +- 3 files changed, 39 insertions(+), 7 deletions(-) diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c index 45f5f9232e71..a90328c41307 100644 --- a/fs/overlayfs/dir.c +++ b/fs/overlayfs/dir.c @@ -114,9 +114,41 @@ int ovl_cleanup_and_whiteout(struct dentry *workdir, struct inode *dir, goto out; } -int ovl_create_real(struct inode *dir, struct dentry *newdentry, +static int ovl_create_real_dir(struct inode *dir, struct dentry **pnewdentry, + umode_t mode) +{ + struct dentry *newdentry = *pnewdentry; + int err; + + err = ovl_do_mkdir(dir, newdentry, mode, true); + /* + * vfs_mkdir() may succeed and leave the dentry passed + * to it unhashed and negative. If that happens, try to + * lookup a new hashed and positive dentry. + */ + if (!err && unlikely(d_unhashed(newdentry))) { + struct dentry *d; + + d = lookup_one_len(newdentry->d_name.name, + newdentry->d_parent, + newdentry->d_name.len); + if (IS_ERR(d)) { + err = PTR_ERR(d); + pr_warn("overlayfs: failed lookup after mkdir (%pd2, err=%i).\n", + newdentry, err); + return err; + } + dput(newdentry); + *pnewdentry = d; + } + + return err; +} + +int ovl_create_real(struct inode *dir, struct dentry **pnewdentry, struct cattr *attr, struct dentry *hardlink, bool debug) { + struct dentry *newdentry = *pnewdentry; int err; if (newdentry->d_inode) @@ -131,7 +163,7 @@ int ovl_create_real(struct inode *dir, struct dentry *newdentry, break; case S_IFDIR: - err = ovl_do_mkdir(dir, newdentry, attr->mode, debug); + err = ovl_create_real_dir(dir, pnewdentry, attr->mode); break; case S_IFCHR: @@ -150,7 +182,7 @@ int ovl_create_real(struct inode *dir, struct dentry *newdentry, err = -EPERM; } } - if (!err && WARN_ON(!newdentry->d_inode)) { + if (!err && WARN_ON(!d_inode(*pnewdentry))) { /* * Not quite sure if non-instantiated dentry is legal or not. * VFS doesn't seem to care so check and warn here. @@ -171,7 +203,7 @@ struct dentry *ovl_create_temp(struct dentry *workdir, struct cattr *attr, if (IS_ERR(temp)) return temp; - err = ovl_create_real(wdir, temp, attr, hardlink, true); + err = ovl_create_real(wdir, &temp, attr, hardlink, true); if (err) { dput(temp); return ERR_PTR(err); @@ -261,7 +293,7 @@ static int ovl_create_upper(struct dentry *dentry, struct inode *inode, err = PTR_ERR(newdentry); if (IS_ERR(newdentry)) goto out_unlock; - err = ovl_create_real(udir, newdentry, attr, hardlink, false); + err = ovl_create_real(udir, &newdentry, attr, hardlink, false); if (err) goto out_dput; diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h index 967183175ef5..a84599268d10 100644 --- a/fs/overlayfs/overlayfs.h +++ b/fs/overlayfs/overlayfs.h @@ -378,7 +378,7 @@ struct cattr { umode_t mode; const char *link; }; -int ovl_create_real(struct inode *dir, struct dentry *newdentry, +int ovl_create_real(struct inode *dir, struct dentry **pnewdentry, struct cattr *attr, struct dentry *hardlink, bool debug); struct dentry *ovl_create_temp(struct dentry *workdir, struct cattr *attr, diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c index 492d534058ae..d83c0543c03c 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -603,7 +603,7 @@ static struct dentry *ovl_workdir_create(struct ovl_fs *ofs, goto retry; } - err = ovl_create_real(dir, work, + err = ovl_create_real(dir, &work, &(struct cattr){.mode = S_IFDIR | 0}, NULL, true); if (err)