Commit aed434ad authored by Al Viro's avatar Al Viro

namei: be careful with mountpoint crossings in follow_dotdot_rcu()

Otherwise we are risking a hard error where nonlazy restart would be the right
thing to do; it's a very narrow race with mount --move and most of the time it
ends up being completely harmless, but it's possible to construct a case when
we'll get a bogus hard error instead of falling back to non-lazy walk...

For one thing, when crossing _into_ overmount of parent we need to check for
mount_lock bumps when we get NULL from __lookup_mnt() as well.

For another, and less exotically, we need to make sure that the data fetched
in follow_up_rcu() had been consistent.  ->mnt_mountpoint is pinned for as
long as it is a mountpoint, but we need to check mount_lock after fetching
to verify that.
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 99ff6cf0
...@@ -1018,21 +1018,6 @@ const char *get_link(struct nameidata *nd) ...@@ -1018,21 +1018,6 @@ const char *get_link(struct nameidata *nd)
return res; return res;
} }
static int follow_up_rcu(struct path *path)
{
struct mount *mnt = real_mount(path->mnt);
struct mount *parent;
struct dentry *mountpoint;
parent = mnt->mnt_parent;
if (&parent->mnt == path->mnt)
return 0;
mountpoint = mnt->mnt_mountpoint;
path->dentry = mountpoint;
path->mnt = &parent->mnt;
return 1;
}
/* /*
* follow_up - Find the mountpoint of path's vfsmount * follow_up - Find the mountpoint of path's vfsmount
* *
...@@ -1289,10 +1274,8 @@ static int follow_dotdot_rcu(struct nameidata *nd) ...@@ -1289,10 +1274,8 @@ static int follow_dotdot_rcu(struct nameidata *nd)
set_root_rcu(nd); set_root_rcu(nd);
while (1) { while (1) {
if (nd->path.dentry == nd->root.dentry && if (path_equal(&nd->path, &nd->root))
nd->path.mnt == nd->root.mnt) {
break; break;
}
if (nd->path.dentry != nd->path.mnt->mnt_root) { if (nd->path.dentry != nd->path.mnt->mnt_root) {
struct dentry *old = nd->path.dentry; struct dentry *old = nd->path.dentry;
struct dentry *parent = old->d_parent; struct dentry *parent = old->d_parent;
...@@ -1300,34 +1283,42 @@ static int follow_dotdot_rcu(struct nameidata *nd) ...@@ -1300,34 +1283,42 @@ static int follow_dotdot_rcu(struct nameidata *nd)
inode = parent->d_inode; inode = parent->d_inode;
seq = read_seqcount_begin(&parent->d_seq); seq = read_seqcount_begin(&parent->d_seq);
if (read_seqcount_retry(&old->d_seq, nd->seq)) if (unlikely(read_seqcount_retry(&old->d_seq, nd->seq)))
goto failed; return -ECHILD;
nd->path.dentry = parent; nd->path.dentry = parent;
nd->seq = seq; nd->seq = seq;
break; break;
} else {
struct mount *mnt = real_mount(nd->path.mnt);
struct mount *mparent = mnt->mnt_parent;
struct dentry *mountpoint = mnt->mnt_mountpoint;
struct inode *inode2 = mountpoint->d_inode;
unsigned seq = read_seqcount_begin(&mountpoint->d_seq);
if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
return -ECHILD;
if (&mparent->mnt == nd->path.mnt)
break;
/* we know that mountpoint was pinned */
nd->path.dentry = mountpoint;
nd->path.mnt = &mparent->mnt;
inode = inode2;
nd->seq = seq;
} }
if (!follow_up_rcu(&nd->path))
break;
inode = nd->path.dentry->d_inode;
nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
} }
while (d_mountpoint(nd->path.dentry)) { while (unlikely(d_mountpoint(nd->path.dentry))) {
struct mount *mounted; struct mount *mounted;
mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry); mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
if (unlikely(read_seqretry(&mount_lock, nd->m_seq)))
return -ECHILD;
if (!mounted) if (!mounted)
break; break;
nd->path.mnt = &mounted->mnt; nd->path.mnt = &mounted->mnt;
nd->path.dentry = mounted->mnt.mnt_root; nd->path.dentry = mounted->mnt.mnt_root;
inode = nd->path.dentry->d_inode; inode = nd->path.dentry->d_inode;
nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
if (read_seqretry(&mount_lock, nd->m_seq))
goto failed;
} }
nd->inode = inode; nd->inode = inode;
return 0; return 0;
failed:
return -ECHILD;
} }
/* /*
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment