• Miklos Szeredi's avatar
    ovl: check whiteout in ovl_create_over_whiteout() · 5e127580
    Miklos Szeredi authored
    Kaixuxia repors that it's possible to crash overlayfs by removing the
    whiteout on the upper layer before creating a directory over it.  This is a
    reproducer:
    
     mkdir lower upper work merge
     touch lower/file
     mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge
     rm merge/file
     ls -al merge/file
     rm upper/file
     ls -al merge/
     mkdir merge/file
    
    Before commencing with a vfs_rename(..., RENAME_EXCHANGE) verify that the
    lookup of "upper" is positive and is a whiteout, and return ESTALE
    otherwise.
    
    Reported by: kaixuxia <xiakaixu1987@gmail.com>
    Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
    Fixes: e9be9d5e ("overlay filesystem")
    Cc: <stable@vger.kernel.org> # v3.18
    5e127580
dir.c 28 KB