• Greg Kurz's avatar
    fuse: Fix infinite loop in sget_fc() · e4a9ccdd
    Greg Kurz authored
    We don't set the SB_BORN flag on submounts. This is wrong as these
    superblocks are then considered as partially constructed or dying
    in the rest of the code and can break some assumptions.
    
    One such case is when you have a virtiofs filesystem with submounts
    and you try to mount it again : virtio_fs_get_tree() tries to obtain
    a superblock with sget_fc(). The logic in sget_fc() is to loop until
    it has either found an existing matching superblock with SB_BORN set
    or to create a brand new one. It is assumed that a superblock without
    SB_BORN is transient and the loop is restarted. Forgetting to set
    SB_BORN on submounts hence causes sget_fc() to retry forever.
    
    Setting SB_BORN requires special care, i.e. a write barrier for
    super_cache_count() which can check SB_BORN without taking any lock.
    We should call vfs_get_tree() to deal with that but this requires
    to have a proper ->get_tree() implementation for submounts, which
    is a bigger piece of work. Go for a simple bug fix in the meatime.
    
    Fixes: bf109c64 ("fuse: implement crossmounts")
    Cc: stable@vger.kernel.org # v5.10+
    Signed-off-by: default avatarGreg Kurz <groug@kaod.org>
    Reviewed-by: default avatarMax Reitz <mreitz@redhat.com>
    Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
    e4a9ccdd
dir.c 48.1 KB