Al Viro
98e151baab
fix dget_parent() fastpath race ...
[ Upstream commit e84009336711d2bba885fc9cea66348ddfce3758 ]
We are overoptimistic about taking the fast path there; seeing
the same value in ->d_parent after having grabbed a reference
to that parent does *not* mean that it has remained our parent
all along.
That wouldn't be a big deal (in the end it is our parent and
we have grabbed the reference we are about to return), but...
the situation with barriers is messed up.
We might have hit the following sequence:
d is a dentry of /tmp/a/b
CPU1: CPU2:
parent = d->d_parent (i.e. dentry of /tmp/a)
rename /tmp/a/b to /tmp/b
rmdir /tmp/a, making its dentry negative
grab reference to parent,
end up with cached parent->d_inode (NULL)
mkdir /tmp/a, rename /tmp/b to /tmp/a/b
recheck d->d_parent, which is back to original
decide that everything's fine and return the reference we'd got.
The trouble is, caller (on CPU1) will observe dget_parent()
returning an apparently negative dentry. It actually is positive,
but CPU1 has stale ->d_inode cached.
Use d->d_seq to see if it has been moved instead of rechecking ->d_parent.
NOTE: we are *NOT* going to retry on any kind of ->d_seq mismatch;
we just go into the slow path in such case. We don't wait for ->d_seq
to become even either - again, if we are racing with renames, we
can bloody well go to slow path anyway.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01 13:14:27 +02:00
9p: Fix memory leak in v9fs_mount
2020-08-19 08:15:06 +02:00
fs/adfs: super: fix use-after-free bug
2019-08-06 19:06:49 +02:00
affs: fix basic permission bits to actually work
2020-09-09 19:04:30 +02:00
afs: Fix NULL deref in afs_dynroot_depopulate()
2020-08-26 10:31:05 +02:00
autofs: fix a leak in autofs_expire_indirect()
2019-12-13 08:51:01 +01:00
fix a series of Documentation/ broken file name references
2018-06-15 18:10:01 -03:00
bfs: add sanity check at bfs_fill_super()
2018-12-01 09:37:27 +01:00
btrfs: fix wrong address when faulting in pages in the search ioctl
2020-09-17 13:45:28 +02:00
cachefiles: Fix race between read_waiter and read_copier involving op->to_do
2020-06-03 08:19:29 +02:00
ceph: don't allow setlease on cephfs
2020-09-09 19:04:23 +02:00
cifs: Fix leak when handling lease break for cached root fid
2020-08-21 11:05:31 +02:00
coda: add error handling for fget
2019-08-06 19:06:51 +02:00
configfs: fix config_item refcnt leak in configfs_rmdir()
2020-05-27 17:37:32 +02:00
Cramfs: fix abad comparison when wrap-arounds occur
2018-11-13 11:08:55 -08:00
fscrypt: clean up some BUG_ON()s in block encryption/decryption
2019-07-26 09:14:02 +02:00
debugfs: fix use-after-free on symlink traversal
2019-05-08 07:21:48 +02:00
fs/devpts: always delete dcache dentry-s in dput()
2019-03-23 20:09:59 +01:00
dlm: Fix kobject memleak
2020-08-19 08:15:02 +02:00
ecryptfs: replace BUG_ON with error handling code
2020-02-28 16:38:59 +01:00
efivars: Call guid_parse() against guid_t type of variable
2018-07-22 14:13:44 +02:00
exofs_mount(): fix leaks on failure exits
2019-12-05 09:20:32 +01:00
exportfs: fix 'passing zero to ERR_PTR()' warning
2020-01-27 14:50:02 +01:00
ext2: don't update mtime on COW faults
2020-09-09 19:04:28 +02:00
fs: prevent BUG_ON in submit_bh_wbc()
2020-09-03 11:24:24 +02:00
f2fs: Return EOF on unaligned end of file DIO read
2020-09-23 12:10:59 +02:00
fat: don't allow to mount if the FAT length == 0
2020-06-22 09:05:08 +02:00
fscache: fix race between enablement and dropping of object
2018-12-17 09:24:40 +01:00
fuse: fix weird page warning
2020-07-29 10:16:46 +02:00
gfs2: initialize transaction tr_ailX_lists earlier
2020-09-23 12:10:56 +02:00
fs/hfs/extent.c: fix array out of bounds read of array extent
2019-12-01 09:17:10 +01:00
hfsplus: fix crash and filesystem corruption when deleting files
2020-04-17 10:48:52 +02:00
vfs: discard ATTR_ATTR_FLAG
2018-08-17 16:20:28 -07:00
hpfs: remove unnecessary checks on the value of r when assigning error code
2018-08-25 12:42:33 -07:00
hugetlb: use same fault hash key for shared and private mappings
2019-05-22 07:37:40 +02:00
isofs: reject hardware sector size > 2048 bytes
2018-08-21 11:37:41 +02:00
jbd2: abort journal if free a async write error metadata buffer
2020-09-03 11:24:24 +02:00
jffs2: fix UAF problem
2020-08-26 10:31:01 +02:00
jfs: fix bogus variable self-initialization
2020-01-27 14:50:33 +01:00
kernfs: fix ino wrap-around detection
2019-12-13 08:52:43 +01:00
lockd: fix decoding of TEST results
2019-12-13 08:51:59 +01:00
fs/minix: remove expected error message in block_to_path()
2020-08-21 11:05:38 +02:00
NFS: Zero-stateid SETATTR should first return delegation
2020-09-23 12:10:58 +02:00
nfsd: apply umask on fs without ACL support
2020-07-09 09:37:11 +02:00
nilfs2: fix null pointer dereference at nilfs_segctor_do_construct()
2020-06-22 09:05:03 +02:00
fanotify: fix ignore mask logic for events on child and on dir
2020-06-30 23:17:00 -04:00
ntfs: mft: remove VLA usage
2018-08-17 16:20:27 -07:00
ocfs2: change slot number type s16 to u16
2020-08-21 11:05:33 +02:00
help_next should increase position index
2020-02-24 08:34:53 +01:00
ovl: fix unneeded call to ovl_change_flags()
2020-07-22 09:32:10 +02:00
proc: Use new_inode not new_inode_pseudo
2020-06-22 09:05:06 +02:00
pstore: Fix linking when crypto API disabled
2020-08-19 08:15:04 +02:00
fs: avoid softlockups in s_inodes iterators
2020-01-12 12:17:20 +01:00
reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
2020-02-24 08:34:52 +01:00
romfs: fix uninitialized memory leak in romfs_dev_read()
2020-08-26 10:30:59 +02:00
Squashfs: Compute expected length from inode size rather than block length
2018-08-02 09:34:02 -07:00
Driver core patches for 4.19-rc1
2018-08-18 11:44:53 -07:00
sysv: return 'err' instead of 0 in __sysv_write_inode
2018-12-17 09:24:30 +01:00
tracefs: Annotate tracefs_ops with __ro_after_init
2018-07-31 11:32:44 -04:00
ubifs: remove broken lazytime support
2020-05-27 17:37:30 +02:00
udf: Fix free space reporting for metadata and virtual partitions
2020-02-24 08:34:45 +01:00
fs/ufs: avoid potential u32 multiplication overflow
2020-08-21 11:05:38 +02:00
xfs: initialize the shortform attr header padding entry
2020-09-17 13:45:25 +02:00
aio: fix async fsync creds
2020-06-22 09:05:01 +02:00
anon_inode_getfile(): switch to alloc_file_pseudo()
2018-07-12 10:04:27 -04:00
fs: Fix attr.c kernel-doc
2018-07-03 16:44:45 -04:00
get rid of 'opened' argument of ->atomic_open() - part 3
2018-07-12 10:04:20 -04:00
fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
2020-06-03 08:19:41 +02:00
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
fs/binfmt_flat.c: make load_flat_shared_library() work
2019-07-03 13:14:44 +02:00
turn filp_clone_open() into inline wrapper for dentry_open()
2018-07-10 23:29:03 -04:00
exec: load_script: Do not exec truncated interpreter path
2019-11-06 13:05:37 +01:00
block: Fix use-after-free in blkdev_get()
2020-06-25 15:33:06 +02:00
fs: prevent BUG_ON in submit_bh_wbc()
2020-09-03 11:24:24 +02:00
chardev: Avoid potential use-after-free in 'chrdev_open()'
2020-01-14 20:06:57 +01:00
fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP
2020-01-09 10:19:07 +01:00
coredump: fix crash when umh is disabled
2020-05-14 07:57:21 +02:00
dax: pass NOWAIT flag to iomap_apply
2020-03-05 16:42:12 +01:00
fix dget_parent() fastpath race
2020-10-01 13:14:27 +02:00
direct-io: allow direct writes to empty inodes
2019-03-05 17:58:50 +01:00
fs: avoid softlockups in s_inodes iterators
2020-01-12 12:17:20 +01:00
eventfd: track eventfd_signal() recursion depth
2020-02-11 04:34:08 -08:00
fix regression in "epoll: Keep a reference on files added to the check list"
2020-09-09 19:04:27 +02:00
exec: Move would_dump into flush_old_exec
2020-05-20 08:18:50 +02:00
signal: Don't send signals to tasks that don't exist
2018-08-15 23:03:20 -05:00
fix multiplication overflow in copy_fdtable()
2020-05-27 17:37:29 +02:00
overlayfs update for 4.19
2018-08-21 18:19:09 -07:00
fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()
2020-04-17 10:48:51 +02:00
writeback: Fix sync livelock due to b_dirty_time processing
2020-09-03 11:24:28 +02:00
futex: Fix inode life-time issue
2020-03-25 08:06:14 +01:00
acct_on(): don't mess with freeze protection
2019-05-31 06:46:05 -07:00
vfs: fix FIGETBSZ ioctl on an overlayfs file
2018-11-21 09:19:14 +01:00
iomap: partially revert 4721a601099 (simulated directio short read on EFAULT)
2019-12-13 08:52:56 +01:00
autofs: remove left-over autofs4 stubs
2018-06-11 08:22:34 -07:00
kconfig: move the "Executable file formats" menu to fs/Kconfig.binfmt
2018-08-02 08:06:55 +09:00
libfs: fix infoleak in simple_attr_read()
2020-04-02 15:28:21 +02:00
locks: print unsigned ino in /proc/locks
2020-01-09 10:19:00 +01:00
autofs: remove left-over autofs4 stubs
2018-06-11 08:22:34 -07:00
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
mpage: mpage_readpages() should submit IO as read-ahead
2018-08-17 16:20:29 -07:00
namei: only return -ECHILD from follow_dotdot_rcu()
2020-03-05 16:42:20 +01:00
fs/namespace.c: fix mountpoint reference counter race
2020-04-29 16:31:26 +02:00
dcache: sort the freeing-without-RCU-delay mess for good.
2019-05-25 18:23:26 +02:00
cifs_atomic_open(): fix double-put on late allocation failure
2020-03-18 07:14:21 +01:00
fs: prevent page refcount overflow in pipe_buf_get
2019-05-04 09:20:11 +02:00
propagate_one(): mnt_set_mountpoint() needs mount_lock
2020-05-02 17:26:01 +02:00
vfs: avoid problematic remapping requests into partial EOF block
2019-12-01 09:17:04 +01:00
filldir[64]: remove WARN_ON_ONCE() for bad directory entries
2020-01-04 19:13:26 +01:00
Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL
2018-06-28 10:40:47 -07:00
seq_file: fix problem when seeking mid-record
2019-08-25 10:47:43 +02:00
fs/signalfd.c: fix inconsistent return codes for signalfd4
2020-08-26 10:31:02 +02:00
splice: only read in as much information as there is pipe buffer space
2019-12-17 20:35:43 +01:00
vfs: Fix EOVERFLOW testing in put_compat_statfs64
2019-10-11 18:21:39 +02:00
Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax
2018-08-26 11:48:42 -07:00
Merge branch 'work.aio' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-08-13 20:56:23 -07:00
userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK
2020-01-04 19:13:18 +01:00
xattr: break delegations in {set,remove}xattr
2020-08-11 15:32:34 +02:00
98e151baab