Overalyfs regression in 4.0

Overalyfs regression in 4.0

[Josh Boyer]

Hi Miklos,

Vincent reported[1] what appears to be a regression in Overlayfs with
4.0.  This was found in the upstream docker community[2] on Ubuntu
with 4.0.1 as well, so it is distro agnostic.  The following sequence
of commands in the bug report seems to allow one to remove a non-empty
directory.

Is this expected behavior now?  I looked through the commits in 4.0
and saw a few that might lead to a behavior change, but I am not
familiar enough with Overalyfs to know if this was intentional or not.

josh

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1220915
[2] https://github.com/docker/docker/issues/13108

Re: Overalyfs regression in 4.0

[Miklos Szeredi]

On Wed, May 13, 2015 at 09:06:26AM -0400, Josh Boyer wrote:
> Hi Miklos,
> 
> Vincent reported[1] what appears to be a regression in Overlayfs with
> 4.0.  This was found in the upstream docker community[2] on Ubuntu
> with 4.0.1 as well, so it is distro agnostic.  The following sequence
> of commands in the bug report seems to allow one to remove a non-empty
> directory.
> 
> Is this expected behavior now?  I looked through the commits in 4.0
> and saw a few that might lead to a behavior change, but I am not
> familiar enough with Overalyfs to know if this was intentional or not.
> 
> josh
> 
> [1] https://bugzilla.redhat.com/show_bug.cgi?id=1220915
> [2] https://github.com/docker/docker/issues/13108

Good report, thanks!

Follwing patch should fix it.

Thanks,
Miklos

---
Subject: ovl: don't remove non-empty opaque directory
From: Miklos Szeredi <mszeredi@suse.cz>

When removing an opaque directory we can't just call rmdir() to check for
emptyness, because the directory will need to be replaced with a whiteout.
The replacement is done with RENAME_EXCHANGE, which doesn't check
emptyness.

Solution is just to check emptyness by reading the directory.  In the
future we could add a new rename flag to check for emptyness even for
RENAME_EXCHANGE to optimize this case.

Reported-by: Vincent Batts <vbatts@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Fixes: 263b4a0fee43 ("ovl: dont replace opaque dir")
Cc: <stable@vger.kernel.org> # v4.0+
---
 fs/overlayfs/dir.c |   24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -506,11 +506,25 @@ static int ovl_remove_and_whiteout(struc
 	struct dentry *opaquedir = NULL;
 	int err;
 
-	if (is_dir && OVL_TYPE_MERGE_OR_LOWER(ovl_path_type(dentry))) {
-		opaquedir = ovl_check_empty_and_clear(dentry);
-		err = PTR_ERR(opaquedir);
-		if (IS_ERR(opaquedir))
-			goto out;
+	if (is_dir) {
+		if (OVL_TYPE_MERGE_OR_LOWER(ovl_path_type(dentry))) {
+			opaquedir = ovl_check_empty_and_clear(dentry);
+			err = PTR_ERR(opaquedir);
+			if (IS_ERR(opaquedir))
+				goto out;
+		} else {
+			LIST_HEAD(list);
+
+			/*
+			 * When removing an empty opaque directory, then it
+			 * makes no sense to replace it with an exact replica of
+			 * itself.  But emptiness still needs to be checked.
+			 */
+			err = ovl_check_empty_dir(dentry, &list);
+			ovl_cache_free(&list);
+			if (err)
+				goto out;
+		}
 	}
 
 	err = ovl_lock_rename_workdir(workdir, upperdir);

Re: Overalyfs regression in 4.0

[Jordi Pujol Palomer]

Hello,

Tested-by: Jordi Pujol Palomer <jordipujolp@gmail.com>

Have compiled the version 4.0.3 adding this patch, it works in a
Live OS,

# rmdir /mnt/
# mkdir -p /mnt
# touch /mnt/file
# rmdir /mnt/
rmdir: failed to remove ‘/mnt/’: Directory not empty
# uname -a
Linux pcjordi 4.0.3-1-haswell-lnet-amd64 #1 SMP PREEMPT Wed May 13 19:38:19 CEST 2015 x86_64 GNU/Linux
# 

Thanks,

Jordi Pujol


EL Wed, 13 May 2015 17:11:01 +0200
Miklos Szeredi <miklos@szeredi.hu> escrigué:

> ---
> Subject: ovl: don't remove non-empty opaque directory
> From: Miklos Szeredi <mszeredi@suse.cz>
> 
> When removing an opaque directory we can't just call rmdir() to check
> for emptyness, because the directory will need to be replaced with a
> whiteout. The replacement is done with RENAME_EXCHANGE, which doesn't
> check emptyness.
> 
> Solution is just to check emptyness by reading the directory.  In the
> future we could add a new rename flag to check for emptyness even for
> RENAME_EXCHANGE to optimize this case.
> 
> Reported-by: Vincent Batts <vbatts@gmail.com>
> Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
> Fixes: 263b4a0fee43 ("ovl: dont replace opaque dir")
> Cc: <stable@vger.kernel.org> # v4.0+
> ---