udf: Protect rename against modification of moved directory

When we are renaming a directory to a different directory, we need to
update '..' entry in the moved directory. However nothing prevents moved
directory from being modified and even converted from the in-ICB format
to the normal format which results in a crash. Fix the problem by
locking the moved directory.

Reported-by: syzbot+aebf90eea2671c43112a@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>

fs/udf/namei.c

@@ -786,6 +786,11 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
 			if (!empty_dir(new_inode))
 				goto out_oiter;
 		}
+		/*
+		 * We need to protect against old_inode getting converted from
+		 * ICB to normal directory.
+		 */
+		inode_lock_nested(old_inode, I_MUTEX_NONDIR2);
 		retval = udf_fiiter_find_entry(old_inode, &dotdot_name,
 					       &diriter);
 		if (retval == -ENOENT) {
@@ -794,8 +799,10 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
 				old_inode->i_ino);
 			retval = -EFSCORRUPTED;
 		}
-		if (retval)
+		if (retval) {
+			inode_unlock(old_inode);
 			goto out_oiter;
+		}
 		has_diriter = true;
 		tloc = lelb_to_cpu(diriter.fi.icb.extLocation);
 		if (udf_get_lb_pblock(old_inode->i_sb, &tloc, 0) !=
@@ -873,6 +880,7 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
 			       udf_dir_entry_len(&diriter.fi));
 		udf_fiiter_write_fi(&diriter, NULL);
 		udf_fiiter_release(&diriter);
+		inode_unlock(old_inode);
 
 		inode_dec_link_count(old_dir);
 		if (new_inode)
@@ -884,8 +892,10 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
 	}
 	return 0;
 out_oiter:
-	if (has_diriter)
+	if (has_diriter) {
 		udf_fiiter_release(&diriter);
+		inode_unlock(old_inode);
+	}
 	udf_fiiter_release(&oiter);
 
 	return retval;