From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Liangyan <liangyan.peng@linux.alibaba.com>,
Joseph Qi <joseph.qi@linux.alibaba.com>,
Al Viro <viro@zeniv.linux.org.uk>,
Miklos Szeredi <mszeredi@redhat.com>
Subject: [PATCH 5.4 32/65] ovl: fix dentry leak in ovl_get_redirect
Date: Mon, 8 Feb 2021 16:01:04 +0100 [thread overview]
Message-ID: <20210208145811.470511391@linuxfoundation.org> (raw)
In-Reply-To: <20210208145810.230485165@linuxfoundation.org>
From: Liangyan <liangyan.peng@linux.alibaba.com>
commit e04527fefba6e4e66492f122cf8cc6314f3cf3bf upstream.
We need to lock d_parent->d_lock before dget_dlock, or this may
have d_lockref updated parallelly like calltrace below which will
cause dentry->d_lockref leak and risk a crash.
CPU 0 CPU 1
ovl_set_redirect lookup_fast
ovl_get_redirect __d_lookup
dget_dlock
//no lock protection here spin_lock(&dentry->d_lock)
dentry->d_lockref.count++ dentry->d_lockref.count++
[ 49.799059] PGD 800000061fed7067 P4D 800000061fed7067 PUD 61fec5067 PMD 0
[ 49.799689] Oops: 0002 [#1] SMP PTI
[ 49.800019] CPU: 2 PID: 2332 Comm: node Not tainted 4.19.24-7.20.al7.x86_64 #1
[ 49.800678] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8a46cfe 04/01/2014
[ 49.801380] RIP: 0010:_raw_spin_lock+0xc/0x20
[ 49.803470] RSP: 0018:ffffac6fc5417e98 EFLAGS: 00010246
[ 49.803949] RAX: 0000000000000000 RBX: ffff93b8da3446c0 RCX: 0000000a00000000
[ 49.804600] RDX: 0000000000000001 RSI: 000000000000000a RDI: 0000000000000088
[ 49.805252] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff993cf040
[ 49.805898] R10: ffff93b92292e580 R11: ffffd27f188a4b80 R12: 0000000000000000
[ 49.806548] R13: 00000000ffffff9c R14: 00000000fffffffe R15: ffff93b8da3446c0
[ 49.807200] FS: 00007ffbedffb700(0000) GS:ffff93b927880000(0000) knlGS:0000000000000000
[ 49.807935] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 49.808461] CR2: 0000000000000088 CR3: 00000005e3f74006 CR4: 00000000003606a0
[ 49.809113] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 49.809758] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 49.810410] Call Trace:
[ 49.810653] d_delete+0x2c/0xb0
[ 49.810951] vfs_rmdir+0xfd/0x120
[ 49.811264] do_rmdir+0x14f/0x1a0
[ 49.811573] do_syscall_64+0x5b/0x190
[ 49.811917] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 49.812385] RIP: 0033:0x7ffbf505ffd7
[ 49.814404] RSP: 002b:00007ffbedffada8 EFLAGS: 00000297 ORIG_RAX: 0000000000000054
[ 49.815098] RAX: ffffffffffffffda RBX: 00007ffbedffb640 RCX: 00007ffbf505ffd7
[ 49.815744] RDX: 0000000004449700 RSI: 0000000000000000 RDI: 0000000006c8cd50
[ 49.816394] RBP: 00007ffbedffaea0 R08: 0000000000000000 R09: 0000000000017d0b
[ 49.817038] R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000012
[ 49.817687] R13: 00000000072823d8 R14: 00007ffbedffb700 R15: 00000000072823d8
[ 49.818338] Modules linked in: pvpanic cirrusfb button qemu_fw_cfg atkbd libps2 i8042
[ 49.819052] CR2: 0000000000000088
[ 49.819368] ---[ end trace 4e652b8aa299aa2d ]---
[ 49.819796] RIP: 0010:_raw_spin_lock+0xc/0x20
[ 49.821880] RSP: 0018:ffffac6fc5417e98 EFLAGS: 00010246
[ 49.822363] RAX: 0000000000000000 RBX: ffff93b8da3446c0 RCX: 0000000a00000000
[ 49.823008] RDX: 0000000000000001 RSI: 000000000000000a RDI: 0000000000000088
[ 49.823658] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff993cf040
[ 49.825404] R10: ffff93b92292e580 R11: ffffd27f188a4b80 R12: 0000000000000000
[ 49.827147] R13: 00000000ffffff9c R14: 00000000fffffffe R15: ffff93b8da3446c0
[ 49.828890] FS: 00007ffbedffb700(0000) GS:ffff93b927880000(0000) knlGS:0000000000000000
[ 49.830725] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 49.832359] CR2: 0000000000000088 CR3: 00000005e3f74006 CR4: 00000000003606a0
[ 49.834085] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 49.835792] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Cc: <stable@vger.kernel.org>
Fixes: a6c606551141 ("ovl: redirect on rename-dir")
Signed-off-by: Liangyan <liangyan.peng@linux.alibaba.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/dir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -940,8 +940,8 @@ static char *ovl_get_redirect(struct den
buflen -= thislen;
memcpy(&buf[buflen], name, thislen);
- tmp = dget_dlock(d->d_parent);
spin_unlock(&d->d_lock);
+ tmp = dget_parent(d);
dput(d);
d = tmp;
next prev parent reply other threads:[~2021-02-08 16:33 UTC|newest]
Thread overview: 74+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-08 15:00 [PATCH 5.4 00/65] 5.4.97-rc1 review Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 01/65] USB: serial: cp210x: add pid/vid for WSDA-200-USB Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 02/65] USB: serial: cp210x: add new VID/PID for supporting Teraoka AD2000 Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 03/65] USB: serial: option: Adding support for Cinterion MV31 Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 04/65] arm64: dts: qcom: c630: keep both touchpad devices enabled Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 05/65] Input: i8042 - unbreak Pegatron C15B Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 06/65] arm64: dts: amlogic: meson-g12: Set FL-adj property value Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 07/65] arm64: dts: rockchip: fix vopl iommu irq on px30 Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 08/65] bpf, cgroup: Fix optlen WARN_ON_ONCE toctou Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 09/65] bpf, cgroup: Fix problematic bounds check Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 10/65] um: virtio: free vu_dev only with the contained struct device Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 11/65] rxrpc: Fix deadlock around release of dst cached on udp tunnel Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 12/65] arm64: dts: ls1046a: fix dcfg address range Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 13/65] igc: set the default return value to -IGC_ERR_NVM in igc_write_nvm_srwr Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 14/65] igc: check return value of ret_val in igc_config_fc_after_link_up Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 15/65] i40e: Revert "i40e: dont report link up for a VF who hasnt enabled queues" Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 16/65] net/mlx5: Fix leak upon failure of rule creation Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 17/65] net: lapb: Copy the skb before sending a packet Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 18/65] net: mvpp2: TCAM entry enable should be written after SRAM data Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 19/65] r8169: fix WoL on shutdown if CONFIG_DEBUG_SHIRQ is set Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 20/65] ARM: dts: sun7i: a20: bananapro: Fix ethernet phy-mode Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 21/65] nvmet-tcp: fix out-of-bounds access when receiving multiple h2cdata PDUs Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 22/65] memblock: do not start bottom-up allocations with kernel_end Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 23/65] USB: gadget: legacy: fix an error code in eth_bind() Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 24/65] USB: usblp: dont call usb_set_interface if theres a single alt Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 25/65] usb: renesas_usbhs: Clear pipe running flag in usbhs_pkt_pop() Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 26/65] usb: dwc2: Fix endpoint direction check in ep_from_windex Greg Kroah-Hartman
2021-02-08 15:00 ` [PATCH 5.4 27/65] usb: dwc3: fix clock issue during resume in OTG mode Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 28/65] usb: xhci-mtk: fix unreleased bandwidth data Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 29/65] usb: xhci-mtk: skip dropping bandwidth of unchecked endpoints Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 30/65] usb: xhci-mtk: break loop when find the endpoint to drop Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 31/65] usb: host: xhci-plat: add priv quirk for skip PHY initialization Greg Kroah-Hartman
2021-02-08 15:01 ` Greg Kroah-Hartman [this message]
2021-02-08 15:01 ` [PATCH 5.4 33/65] mac80211: fix station rate table updates on assoc Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 34/65] fgraph: Initialize tracing_graph_pause at task creation Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 35/65] kretprobe: Avoid re-registration of the same kretprobe earlier Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 36/65] libnvdimm/dimm: Avoid race between probe and available_slots_show() Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 37/65] genirq/msi: Activate Multi-MSI early when MSI_FLAG_ACTIVATE_EARLY is set Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 38/65] xhci: fix bounce buffer usage for non-sg list case Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 39/65] cifs: report error instead of invalid when revalidating a dentry fails Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 40/65] smb3: Fix out-of-bounds bug in SMB2_negotiate() Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 41/65] smb3: fix crediting for compounding when only one request in flight Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 42/65] mmc: core: Limit retries when analyse of SDIO tuples fails Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 43/65] drm/amd/display: Revert "Fix EDID parsing after resume from suspend" Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 44/65] nvme-pci: avoid the deepest sleep state on Kingston A2000 SSDs Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 45/65] KVM: SVM: Treat SVM as unsupported when running as an SEV guest Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 46/65] KVM: x86: Update emulator context mode if SYSENTER xfers to 64-bit mode Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 47/65] ARM: footbridge: fix dc21285 PCI configuration accessors Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 48/65] mm: hugetlbfs: fix cannot migrate the fallocated HugeTLB page Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 49/65] mm: hugetlb: fix a race between freeing and dissolving the page Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 50/65] mm: hugetlb: fix a race between isolating and freeing page Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 51/65] mm: hugetlb: remove VM_BUG_ON_PAGE from page_huge_active Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 52/65] mm, compaction: move high_pfn to the for loop scope Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 53/65] mm: thp: fix MADV_REMOVE deadlock on shmem THP Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 54/65] x86/build: Disable CET instrumentation in the kernel Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 55/65] x86/apic: Add extra serialization for non-serializing MSRs Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 56/65] iwlwifi: mvm: dont send RFH_QUEUE_CONFIG_CMD with no queues Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 57/65] Input: xpad - sync supported devices with fork on GitHub Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 58/65] iommu/vt-d: Do not use flush-queue when caching-mode is on Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 59/65] md: Set prev_flush_start and flush_bio in an atomic way Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 60/65] igc: Report speed and duplex as unknown when device is runtime suspended Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 61/65] neighbour: Prevent a dead entry from updating gc_list Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 62/65] net: ip_tunnel: fix mtu calculation Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 63/65] net: dsa: mv88e6xxx: override existent unicast portvec in port_fdb_add Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 64/65] net: sched: replaced invalid qdisc tree flush helper in qdisc_replace Greg Kroah-Hartman
2021-02-08 15:01 ` [PATCH 5.4 65/65] usb: host: xhci: mvebu: make USB 3.0 PHY optional for Armada 3720 Greg Kroah-Hartman
2021-02-08 17:39 ` [PATCH 5.4 00/65] 5.4.97-rc1 review Florian Fainelli
2021-02-10 8:28 ` Greg Kroah-Hartman
2021-02-08 20:42 ` Shuah Khan
2021-02-09 5:50 ` Naresh Kamboju
2021-02-09 11:00 ` Igor Torrente
2021-02-10 8:29 ` Greg Kroah-Hartman
2021-02-09 18:14 ` Guenter Roeck
2021-02-10 1:23 ` Ross Schmidt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210208145811.470511391@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=joseph.qi@linux.alibaba.com \
--cc=liangyan.peng@linux.alibaba.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mszeredi@redhat.com \
--cc=stable@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox