Re: [RFC PATCH 1/6] fs/9p: Add ability to identify inode by path for .L

[Al Viro <viro@zeniv.linux.org.uk>]

On Sun, Apr 06, 2025 at 09:43:02PM +0100, Tingmao Wang wrote:
> +bool ino_path_compare(struct v9fs_ino_path *ino_path,
> +			     struct dentry *dentry)
> +{
> +	struct dentry *curr = dentry;
> +	struct qstr *curr_name;
> +	struct name_snapshot *compare;
> +	ssize_t i;
> +
> +	lockdep_assert_held_read(&v9fs_dentry2v9ses(dentry)->rename_sem);
> +
> +	rcu_read_lock();
> +	for (i = ino_path->nr_components - 1; i >= 0; i--) {
> +		if (curr->d_parent == curr) {
> +			/* We're supposed to have more components to walk */
> +			rcu_read_unlock();
> +			return false;
> +		}
> +		curr_name = &curr->d_name;
> +		compare = &ino_path->names[i];
> +		/*
> +		 * We can't use hash_len because it is salted with the parent
> +		 * dentry pointer.  We could make this faster by pre-computing our
> +		 * own hashlen for compare and ino_path outside, probably.
> +		 */
> +		if (curr_name->len != compare->name.len) {
> +			rcu_read_unlock();
> +			return false;
> +		}
> +		if (strncmp(curr_name->name, compare->name.name,
> +			    curr_name->len) != 0) {

... without any kind of protection for curr_name.  Incidentally,
what about rename()?  Not a cross-directory one, just one that
changes the name of a subdirectory within the same parent?