From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752179AbcGANtc (ORCPT ); Fri, 1 Jul 2016 09:49:32 -0400 Received: from fieldses.org ([173.255.197.46]:51604 "EHLO fieldses.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751932AbcGANtb (ORCPT ); Fri, 1 Jul 2016 09:49:31 -0400 Date: Fri, 1 Jul 2016 09:47:05 -0400 From: "J. Bruce Fields" To: Jeff Layton Cc: Miklos Szeredi , Al Viro , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-unionfs@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] locks: use file_inode() Message-ID: <20160701134705.GA20327@fieldses.org> References: <1467377767-12845-1-git-send-email-mszeredi@redhat.com> <1467378310.7477.3.camel@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1467378310.7477.3.camel@redhat.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Jul 01, 2016 at 09:05:10AM -0400, Jeff Layton wrote: > On Fri, 2016-07-01 at 14:56 +0200, Miklos Szeredi wrote: > > (Another one for the f_path debacle.) > > > > ltp fcntl33 testcase caused an Oops in selinux_file_send_sigiotask. > > > > The reason is that generic_add_lease() used filp->f_path.dentry->inode > > while all the others use file_inode().  This makes a difference for files > > opened on overlayfs since the former will point to the overlay inode the > > latter to the underlying inode. > > > > So generic_add_lease() added the lease to the overlay inode and > > generic_delete_lease() removed it from the underlying inode.  When the file > > was released the lease remained on the overlay inode's lock list, resulting > > in use after free. > > > > Reported-by: Eryu Guan > > Signed-off-by: Miklos Szeredi > > Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay") > > Cc: > > Cc: Jeff Layton > > Cc: "J. Bruce Fields" > > --- > >  fs/locks.c | 2 +- > >  1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/fs/locks.c b/fs/locks.c > > index 7c5f91be9b65..ee1b15f6fc13 100644 > > --- a/fs/locks.c > > +++ b/fs/locks.c > > @@ -1628,7 +1628,7 @@ generic_add_lease(struct file *filp, long arg, struct file_lock **flp, void **pr > >  { > >   struct file_lock *fl, *my_fl = NULL, *lease; > >   struct dentry *dentry = filp->f_path.dentry; > > - struct inode *inode = dentry->d_inode; > > + struct inode *inode = file_inode(filp); > >   struct file_lock_context *ctx; > >   bool is_deleg = (*flp)->fl_flags & FL_DELEG; > >   int error; > > Looks good. Al or Bruce, if either of you have remaining patches this > cycle then could one of you take this one? Otherwise, I can queue up a > branch with it. > > Reviewed-by: Jeff Layton I'll take it and pass it along in a pull request later today, unless somebody tells me otherwise. --b.