]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit - fs/dcache.c
lock_parent() needs to recheck if dentry got __dentry_kill'ed under it
authorAl Viro <viro@zeniv.linux.org.uk>
Sat, 24 Feb 2018 01:47:17 +0000 (20:47 -0500)
committerThadeu Lima de Souza Cascardo <cascardo@canonical.com>
Wed, 21 Mar 2018 16:40:21 +0000 (13:40 -0300)
commitb35e27a64a4757acd08e463b80860e3e1c24d583
treecf918d0ef9150574b9dd37c91af6051ab0ebe00c
parent9c2a3e6054f8c97093f5243ff755060d03006a4d
lock_parent() needs to recheck if dentry got __dentry_kill'ed under it

BugLink: http://bugs.launchpad.net/bugs/1757465
commit 3b821409632ab778d46e807516b457dfa72736ed upstream.

In case when dentry passed to lock_parent() is protected from freeing only
by the fact that it's on a shrink list and trylock of parent fails, we
could get hit by __dentry_kill() (and subsequent dentry_kill(parent))
between unlocking dentry and locking presumed parent.  We need to recheck
that dentry is alive once we lock both it and parent *and* postpone
rcu_read_unlock() until after that point.  Otherwise we could return
a pointer to struct dentry that already is rcu-scheduled for freeing, with
->d_lock held on it; caller's subsequent attempt to unlock it can end
up with memory corruption.

Cc: stable@vger.kernel.org # 3.12+, counting backports
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
fs/dcache.c