diff options
| author | Amir Goldstein <[email protected]> | 2025-08-18 09:23:55 +0000 |
|---|---|---|
| committer | Amir Goldstein <[email protected]> | 2025-08-18 11:16:49 +0000 |
| commit | e8bd877fb76bb9f35253e8f41ce0c772269934dd (patch) | |
| tree | f930f4074fb3b77e717b621bf0925cb1b5e7aab0 /drivers/pci/controller/vmd.c | |
| parent | ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (diff) | |
| download | kernel-e8bd877fb76bb9f35253e8f41ce0c772269934dd.tar.gz kernel-e8bd877fb76bb9f35253e8f41ce0c772269934dd.zip | |
ovl: fix possible double unlink
commit 9d23967b18c6 ("ovl: simplify an error path in
ovl_copy_up_workdir()") introduced the helper ovl_cleanup_unlocked(),
which is later used in several following patches to re-acquire the parent
inode lock and unlink a dentry that was earlier found using lookup.
This helper was eventually renamed to ovl_cleanup().
The helper ovl_parent_lock() is used to re-acquire the parent inode lock.
After acquiring the parent inode lock, the helper verifies that the
dentry has not since been moved to another parent, but it failed to
verify that the dentry wasn't unlinked from the parent.
This means that now every call to ovl_cleanup() could potentially
race with another thread, unlinking the dentry to be cleaned up
underneath overlayfs and trigger a vfs assertion.
Reported-by: [email protected]
Tested-by: [email protected]
Fixes: 9d23967b18c6 ("ovl: simplify an error path in ovl_copy_up_workdir()")
Suggested-by: NeilBrown <[email protected]>
Signed-off-by: Amir Goldstein <[email protected]>
Diffstat (limited to 'drivers/pci/controller/vmd.c')
0 files changed, 0 insertions, 0 deletions