@@ -782,6 +782,11 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
if (!empty_dir(new_inode))
goto out_oiter;
}
+ /*
+ * We need to protect against old_inode getting converted from
+ * ICB to normal directory.
+ */
+ inode_lock_nested(old_inode, I_MUTEX_NONDIR2);
retval = udf_fiiter_find_entry(old_inode, &dotdot_name,
&diriter);
if (retval == -ENOENT) {
@@ -790,8 +795,10 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
old_inode->i_ino);
retval = -EFSCORRUPTED;
}
- if (retval)
+ if (retval) {
+ inode_unlock(old_inode);
goto out_oiter;
+ }
has_diriter = true;
tloc = lelb_to_cpu(diriter.fi.icb.extLocation);
if (udf_get_lb_pblock(old_inode->i_sb, &tloc, 0) !=
@@ -869,6 +876,7 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
udf_dir_entry_len(&diriter.fi));
udf_fiiter_write_fi(&diriter, NULL);
udf_fiiter_release(&diriter);
+ inode_unlock(old_inode);
inode_dec_link_count(old_dir);
if (new_inode)
@@ -880,8 +888,10 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
}
return 0;
out_oiter:
- if (has_diriter)
+ if (has_diriter) {
udf_fiiter_release(&diriter);
+ inode_unlock(old_inode);
+ }
udf_fiiter_release(&oiter);
return retval;
When we are renaming a directory to a different directory, we need to update '..' entry in the moved directory. However nothing prevents moved directory from being modified and even converted from the in-ICB format to the normal format which results in a crash. Fix the problem by locking the moved directory. Reported-by: syzbot+aebf90eea2671c43112a@syzkaller.appspotmail.com Signed-off-by: Jan Kara <jack@suse.cz> --- fs/udf/namei.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)