From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Liangyan <liangyan.peng@linux.alibaba.com>,
Joseph Qi <joseph.qi@linux.alibaba.com>,
Al Viro <viro@zeniv.linux.org.uk>,
Miklos Szeredi <mszeredi@redhat.com>
Subject: [PATCH 5.4 32/65] ovl: fix dentry leak in ovl_get_redirect
Date: Mon, 8 Feb 2021 16:01:04 +0100 [thread overview]
Message-ID: <20210208145811.470511391@linuxfoundation.org> (raw)
In-Reply-To: <20210208145810.230485165@linuxfoundation.org>
From: Liangyan <liangyan.peng@linux.alibaba.com>
commit e04527fefba6e4e66492f122cf8cc6314f3cf3bf upstream.
We need to lock d_parent->d_lock before dget_dlock, or this may
have d_lockref updated parallelly like calltrace below which will
cause dentry->d_lockref leak and risk a crash.
CPU 0 CPU 1
ovl_set_redirect lookup_fast
ovl_get_redirect __d_lookup
dget_dlock
//no lock protection here spin_lock(&dentry->d_lock)
dentry->d_lockref.count++ dentry->d_lockref.count++
[ 49.799059] PGD 800000061fed7067 P4D 800000061fed7067 PUD 61fec5067 PMD 0
[ 49.799689] Oops: 0002 [#1] SMP PTI
[ 49.800019] CPU: 2 PID: 2332 Comm: node Not tainted 4.19.24-7.20.al7.x86_64 #1
[ 49.800678] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8a46cfe 04/01/2014
[ 49.801380] RIP: 0010:_raw_spin_lock+0xc/0x20
[ 49.803470] RSP: 0018:ffffac6fc5417e98 EFLAGS: 00010246
[ 49.803949] RAX: 0000000000000000 RBX: ffff93b8da3446c0 RCX: 0000000a00000000
[ 49.804600] RDX: 0000000000000001 RSI: 000000000000000a RDI: 0000000000000088
[ 49.805252] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff993cf040
[ 49.805898] R10: ffff93b92292e580 R11: ffffd27f188a4b80 R12: 0000000000000000
[ 49.806548] R13: 00000000ffffff9c R14: 00000000fffffffe R15: ffff93b8da3446c0
[ 49.807200] FS: 00007ffbedffb700(0000) GS:ffff93b927880000(0000) knlGS:0000000000000000
[ 49.807935] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 49.808461] CR2: 0000000000000088 CR3: 00000005e3f74006 CR4: 00000000003606a0
[ 49.809113] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 49.809758] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 49.810410] Call Trace:
[ 49.810653] d_delete+0x2c/0xb0
[ 49.810951] vfs_rmdir+0xfd/0x120
[ 49.811264] do_rmdir+0x14f/0x1a0
[ 49.811573] do_syscall_64+0x5b/0x190
[ 49.811917] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 49.812385] RIP: 0033:0x7ffbf505ffd7
[ 49.814404] RSP: 002b:00007ffbedffada8 EFLAGS: 00000297 ORIG_RAX: 0000000000000054
[ 49.815098] RAX: ffffffffffffffda RBX: 00007ffbedffb640 RCX: 00007ffbf505ffd7
[ 49.815744] RDX: 0000000004449700 RSI: 0000000000000000 RDI: 0000000006c8cd50
[ 49.816394] RBP: 00007ffbedffaea0 R08: 0000000000000000 R09: 0000000000017d0b
[ 49.817038] R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000012
[ 49.817687] R13: 00000000072823d8 R14: 00007ffbedffb700 R15: 00000000072823d8
[ 49.818338] Modules linked in: pvpanic cirrusfb button qemu_fw_cfg atkbd libps2 i8042
[ 49.819052] CR2: 0000000000000088
[ 49.819368] ---[ end trace 4e652b8aa299aa2d ]---
[ 49.819796] RIP: 0010:_raw_spin_lock+0xc/0x20
[ 49.821880] RSP: 0018:ffffac6fc5417e98 EFLAGS: 00010246
[ 49.822363] RAX: 0000000000000000 RBX: ffff93b8da3446c0 RCX: 0000000a00000000
[ 49.823008] RDX: 0000000000000001 RSI: 000000000000000a RDI: 0000000000000088
[ 49.823658] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff993cf040
[ 49.825404] R10: ffff93b92292e580 R11: ffffd27f188a4b80 R12: 0000000000000000
[ 49.827147] R13: 00000000ffffff9c R14: 00000000fffffffe R15: ffff93b8da3446c0
[ 49.828890] FS: 00007ffbedffb700(0000) GS:ffff93b927880000(0000) knlGS:0000000000000000
[ 49.830725] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 49.832359] CR2: 0000000000000088 CR3: 00000005e3f74006 CR4: 00000000003606a0
[ 49.834085] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 49.835792] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Cc: <stable@vger.kernel.org>
Fixes: a6c606551141 ("ovl: redirect on rename-dir")
Signed-off-by: Liangyan <liangyan.peng@linux.alibaba.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/dir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -940,8 +940,8 @@ static char *ovl_get_redirect(struct den
buflen -= thislen;
memcpy(&buf[buflen], name, thislen);
- tmp = dget_dlock(d->d_parent);
spin_unlock(&d->d_lock);
+ tmp = dget_parent(d);
dput(d);
d = tmp;
next prev parent reply other threads:[~2021-02-08 16:33 UTC|newest]
Thread overview: 74+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-08 15:00 [PATCH 5.4 00/65] 5.4.97-rc1 review Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 01/65] USB: serial: cp210x: add pid/vid for WSDA-200-USB Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 02/65] USB: serial: cp210x: add new VID/PID for supporting Teraoka AD2000 Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 03/65] USB: serial: option: Adding support for Cinterion MV31 Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 04/65] arm64: dts: qcom: c630: keep both touchpad devices enabled Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 05/65] Input: i8042 - unbreak Pegatron C15B Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 06/65] arm64: dts: amlogic: meson-g12: Set FL-adj property value Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 07/65] arm64: dts: rockchip: fix vopl iommu irq on px30 Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 08/65] bpf, cgroup: Fix optlen WARN_ON_ONCE toctou Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 09/65] bpf, cgroup: Fix problematic bounds check Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 10/65] um: virtio: free vu_dev only with the contained struct device Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 11/65] rxrpc: Fix deadlock around release of dst cached on udp tunnel Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 12/65] arm64: dts: ls1046a: fix dcfg address range Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 13/65] igc: set the default return value to -IGC_ERR_NVM in igc_write_nvm_srwr Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 14/65] igc: check return value of ret_val in igc_config_fc_after_link_up Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 15/65] i40e: Revert "i40e: dont report link up for a VF who hasnt enabled queues" Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 16/65] net/mlx5: Fix leak upon failure of rule creation Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 17/65] net: lapb: Copy the skb before sending a packet Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 18/65] net: mvpp2: TCAM entry enable should be written after SRAM data Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 19/65] r8169: fix WoL on shutdown if CONFIG_DEBUG_SHIRQ is set Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 20/65] ARM: dts: sun7i: a20: bananapro: Fix ethernet phy-mode Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 21/65] nvmet-tcp: fix out-of-bounds access when receiving multiple h2cdata PDUs Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 22/65] memblock: do not start bottom-up allocations with kernel_end Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 23/65] USB: gadget: legacy: fix an error code in eth_bind() Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 24/65] USB: usblp: dont call usb_set_interface if theres a single alt Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 25/65] usb: renesas_usbhs: Clear pipe running flag in usbhs_pkt_pop() Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 26/65] usb: dwc2: Fix endpoint direction check in ep_from_windex Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 27/65] usb: dwc3: fix clock issue during resume in OTG mode Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 28/65] usb: xhci-mtk: fix unreleased bandwidth data Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 29/65] usb: xhci-mtk: skip dropping bandwidth of unchecked endpoints Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 30/65] usb: xhci-mtk: break loop when find the endpoint to drop Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 31/65] usb: host: xhci-plat: add priv quirk for skip PHY initialization Greg Kroah-Hartman
2021-02-08 15:01 ` Greg Kroah-Hartman [this message]
2021-02-08 15:01 ` [PATCH 5.4 33/65] mac80211: fix station rate table updates on assoc Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 34/65] fgraph: Initialize tracing_graph_pause at task creation Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 35/65] kretprobe: Avoid re-registration of the same kretprobe earlier Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 36/65] libnvdimm/dimm: Avoid race between probe and available_slots_show() Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 37/65] genirq/msi: Activate Multi-MSI early when MSI_FLAG_ACTIVATE_EARLY is set Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 38/65] xhci: fix bounce buffer usage for non-sg list case Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 39/65] cifs: report error instead of invalid when revalidating a dentry fails Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 40/65] smb3: Fix out-of-bounds bug in SMB2_negotiate() Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 41/65] smb3: fix crediting for compounding when only one request in flight Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 42/65] mmc: core: Limit retries when analyse of SDIO tuples fails Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 43/65] drm/amd/display: Revert "Fix EDID parsing after resume from suspend" Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 44/65] nvme-pci: avoid the deepest sleep state on Kingston A2000 SSDs Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 45/65] KVM: SVM: Treat SVM as unsupported when running as an SEV guest Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 46/65] KVM: x86: Update emulator context mode if SYSENTER xfers to 64-bit mode Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 47/65] ARM: footbridge: fix dc21285 PCI configuration accessors Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 48/65] mm: hugetlbfs: fix cannot migrate the fallocated HugeTLB page Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 49/65] mm: hugetlb: fix a race between freeing and dissolving the page Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 50/65] mm: hugetlb: fix a race between isolating and freeing page Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 51/65] mm: hugetlb: remove VM_BUG_ON_PAGE from page_huge_active Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 52/65] mm, compaction: move high_pfn to the for loop scope Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 53/65] mm: thp: fix MADV_REMOVE deadlock on shmem THP Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 54/65] x86/build: Disable CET instrumentation in the kernel Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 55/65] x86/apic: Add extra serialization for non-serializing MSRs Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 56/65] iwlwifi: mvm: dont send RFH_QUEUE_CONFIG_CMD with no queues Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 57/65] Input: xpad - sync supported devices with fork on GitHub Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 58/65] iommu/vt-d: Do not use flush-queue when caching-mode is on Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 59/65] md: Set prev_flush_start and flush_bio in an atomic way Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 60/65] igc: Report speed and duplex as unknown when device is runtime suspended Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 61/65] neighbour: Prevent a dead entry from updating gc_list Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 62/65] net: ip_tunnel: fix mtu calculation Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 63/65] net: dsa: mv88e6xxx: override existent unicast portvec in port_fdb_add Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 64/65] net: sched: replaced invalid qdisc tree flush helper in qdisc_replace Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 65/65] usb: host: xhci: mvebu: make USB 3.0 PHY optional for Armada 3720 Greg Kroah-Hartman
2021-02-08 17:39 ` [PATCH 5.4 00/65] 5.4.97-rc1 review Florian Fainelli
2021-02-10 8:28 ` Greg Kroah-Hartman
2021-02-08 20:42 ` Shuah Khan
2021-02-09 5:50 ` Naresh Kamboju
2021-02-09 11:00 ` Igor Torrente
2021-02-10 8:29 ` Greg Kroah-Hartman
2021-02-09 18:14 ` Guenter Roeck
2021-02-10 1:23 ` Ross Schmidt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210208145811.470511391@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=joseph.qi@linux.alibaba.com \
--cc=liangyan.peng@linux.alibaba.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mszeredi@redhat.com \
--cc=stable@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.