• Amir Goldstein's avatar
    ovl: use inode_insert5() to hash a newly created inode · 01b39dcc
    Amir Goldstein authored
    Currently, there is a small window where ovl_obtain_alias() can
    race with ovl_instantiate() and create two different overlay inodes
    with the same underlying real non-dir non-hardlink inode.
    
    The race requires an adversary to guess the file handle of the
    yet to be created upper inode and decode the guessed file handle
    after ovl_creat_real(), but before ovl_instantiate().
    This race does not affect overlay directory inodes, because those
    are decoded via ovl_lookup_real() and not with ovl_obtain_alias().
    
    This patch fixes the race, by using inode_insert5() to add a newly
    created inode to cache.
    
    If the newly created inode apears to already exist in cache (hashed
    by the same real upper inode), we instantiate the dentry with the old
    inode and drop the new inode, instead of silently not hashing the new
    inode.
    Signed-off-by: default avatarAmir Goldstein <amir73il@gmail.com>
    Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
    01b39dcc
inode.c 22.5 KB