Commit c1892c37 authored by Miklos Szeredi's avatar Miklos Szeredi

vfs: fix deadlock in file_remove_privs() on overlayfs

file_remove_privs() is called with inode lock on file_inode(), which
proceeds to calling notify_change() on file->f_path.dentry.  Which triggers
the WARN_ON_ONCE(!inode_is_locked(inode)) in addition to deadlocking later
when ovl_setattr tries to lock the underlying inode again.

Fix this mess by not mixing the layers, but doing everything on underlying
dentry/inode.
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
Fixes: 07a2daab ("ovl: Copy up underlying inode's ->i_mode to overlay inode")
Cc: <stable@vger.kernel.org>
parent 523d939e
...@@ -1740,8 +1740,8 @@ static int __remove_privs(struct dentry *dentry, int kill) ...@@ -1740,8 +1740,8 @@ static int __remove_privs(struct dentry *dentry, int kill)
*/ */
int file_remove_privs(struct file *file) int file_remove_privs(struct file *file)
{ {
struct dentry *dentry = file->f_path.dentry; struct dentry *dentry = file_dentry(file);
struct inode *inode = d_inode(dentry); struct inode *inode = file_inode(file);
int kill; int kill;
int error = 0; int error = 0;
...@@ -1749,7 +1749,7 @@ int file_remove_privs(struct file *file) ...@@ -1749,7 +1749,7 @@ int file_remove_privs(struct file *file)
if (IS_NOSEC(inode)) if (IS_NOSEC(inode))
return 0; return 0;
kill = file_needs_remove_privs(file); kill = dentry_needs_remove_privs(dentry);
if (kill < 0) if (kill < 0)
return kill; return kill;
if (kill) if (kill)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment