Commit d0d27277 authored by Linus Torvalds's avatar Linus Torvalds

vfs: make sure we don't have a stale root path if unlazy_walk() fails

When I moved the RCU walk termination into unlazy_walk(), I didn't copy
quite all of it: for the successful RCU termination we properly add the
necessary reference counts to our temporary copy of the root path, but
for the failure case we need to make sure that any temporary root path
information is cleared out (since it does _not_ have the proper
reference counts from the RCU lookup).

We could clean up this mess by just always dropping the temporary root
information, but Al points out that that would mean that a single lookup
through symlinks could see multiple different root entries if it races
with another thread doing chroot.  Not that I think we should really
care (we had that before too, back before we had a copy of the root path
in the nameidata).

Al says he has a cunning plan.  In the meantime, this is the minimal fix
for the problem, even if it's not all that pretty.
Reported-by: default avatarMace Moneta <moneta.mace@gmail.com>
Acked-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 26b0332e
......@@ -574,9 +574,12 @@ static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
drop_dentry:
unlock_rcu_walk();
dput(dentry);
return -ECHILD;
goto drop_root_mnt;
out:
unlock_rcu_walk();
drop_root_mnt:
if (!(nd->flags & LOOKUP_ROOT))
nd->root.mnt = NULL;
return -ECHILD;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment