[PATCH] apparmor: fix double d_instantiate() in ns_mkdir_op()

[PATCH] apparmor: fix double d_instantiate() in ns_mkdir_op()

[Ran Hongyun]

ns_mkdir_op() drops inode_lock for simple_pin_fs() and re-acquires it
before instantiating the dentry.  A concurrent mkdir() of the same name
can pass the VFS negative-dentry checks in that window and also reach
d_instantiate(), tripping BUG_ON(!hlist_unhashed(&d_alias)).

Re-check that the dentry is still negative after re-acquiring inode_lock
and return -EEXIST if a concurrent mkdir() won the race.

Fixes: 4ae47f33354a ("apparmor: add mkdir/rmdir interface to manage policy namespaces")
Signed-off-by: Ran Hongyun <ranhongyun1@huawei.com>
---
 security/apparmor/apparmorfs.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index a99366467217..5a9565eeb62b 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -2111,6 +2111,12 @@ static struct dentry *ns_mkdir_op(const struct mnt_idmap *idmap, struct inode *d
 	if (error)
 		goto out;
 
+	/* the dentry may be instantiated by a concurrent mkdir */
+	if (unlikely(d_really_is_positive(dentry))) {
+		error = -EEXIST;
+		goto out_pin;
+	}
+
 	error = __aafs_setup_d_inode(dir, dentry, mode | S_IFDIR,  NULL,
 				     NULL, NULL, NULL);
 	if (error)
-- 
2.52.0

Re: [PATCH] apparmor: fix double d_instantiate() in ns_mkdir_op()

[sashiko-bot]

> ns_mkdir_op() drops inode_lock for simple_pin_fs() and re-acquires it
> before instantiating the dentry.  A concurrent mkdir() of the same name
> can pass the VFS negative-dentry checks in that window and also reach
> d_instantiate(), tripping BUG_ON(!hlist_unhashed(&d_alias)).
> 
> Re-check that the dentry is still negative after re-acquiring inode_lock
> and return -EEXIST if a concurrent mkdir() won the race.
> 
> Fixes: 4ae47f33354a ("apparmor: add mkdir/rmdir interface to manage policy namespaces")
> Signed-off-by: Ran Hongyun <ranhongyun1@huawei.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109025600.2031008-1-ranhongyun1@huawei.com?part=1