From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from zeniv.linux.org.uk ([195.92.253.2]:44276 "EHLO ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752698AbdLGMjl (ORCPT ); Thu, 7 Dec 2017 07:39:41 -0500 Date: Thu, 7 Dec 2017 12:39:37 +0000 From: Al Viro To: =?utf-8?B?56mG6Zi/5rWpKOWnnOW8iyk=?= Cc: linux-fsdevel@vger.kernel.org, =?utf-8?B?5rih5rOi?= , =?utf-8?B?5byg56S85bm/KOS5seefsyk=?= Subject: Re: [PATCH] fs/vfs: Release allocated dentry on failure in do_last() Message-ID: <20171207123937.GB21978@ZenIV.linux.org.uk> References: <1512614782-46982-1-git-send-email-ahao.mah@alibaba-inc.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1512614782-46982-1-git-send-email-ahao.mah@alibaba-inc.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Thu, Dec 07, 2017 at 10:46:22AM +0800, 穆阿浩(姜弋) wrote: > This issue is found when creating /dev/sdtest with flags (O_CREAT | > O_DIRECT). The file still can be retrieved even after system reports > failure (-EINVAL) for it. Reporting error on creating the file is > correct behaviour because either devtmpfs or tmpfs doesn't support > O_DIRECT for regular file. However, it's incorrect that the file is > still existing. The cause is the newly allocated dentry and inode > aren't released on failure in do_last(). > # rm /dev/sdtest > # dd if=/dev/urandom of=/dev/sdtest bs=4k count=1 oflag=direct > <-EINVAL is returned> > # ls /dev/sdtest > > > This fixes the issue by releasing the dentry, thus the inode on failure > in do_last(). With this applied, the file (/dev/sdtest) isn't seen > in this scenario. > + if (error && (*opened & FILE_OPENED)) > + dput(path.dentry); NAK. For one thing, it's racy as hell even on tmpfs - plain open() from another process would've succeeded in that window. For another, it's outright exploitable on filesystems where dentry tree does not contain all the existing directory tree (anything disk-based, for starters).