netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Tuomas Tynkkynen <tuomas@tuxera.com>
To: Al Viro <viro@zeniv.linux.org.uk>
Cc: <v9fs-developer@lists.sourceforge.net>,
	Eric Van Hensbergen <ericvh@gmail.com>,
	Ron Minnich <rminnich@sandia.gov>,
	Latchesar Ionkov <lucho@ionkov.net>,
	"David S. Miller" <davem@davemloft.net>,
	<linux-kernel@vger.kernel.org>, <netdev@vger.kernel.org>,
	<linux-fsdevel@vger.kernel.org>,
	Tuomas Tynkkynen <tuomas@tuxera.com>, <stable@vger.kernel.org>
Subject: [PATCH 1/2] fs/9p: Compare qid.path in v9fs_test_inode
Date: Wed, 6 Sep 2017 17:59:07 +0300	[thread overview]
Message-ID: <20170906145908.8082-2-tuomas@tuxera.com> (raw)
In-Reply-To: <20170906145908.8082-1-tuomas@tuxera.com>

Commit fd2421f54423 ("fs/9p: When doing inode lookup compare qid details
and inode mode bits.") transformed v9fs_qid_iget() to use iget5_locked()
instead of iget_locked(). However, the test() callback is not checking
fid.path at all, which means that a lookup in the inode cache can now
accidentally locate a completely wrong inode from the same inode hash
bucket if the other fields (qid.type and qid.version) match.

Fixes: fd2421f54423 ("fs/9p: When doing inode lookup compare qid details and inode mode bits.")
Cc: stable@vger.kernel.org
Reviewed-by: Latchesar Ionkov <lucho@ionkov.net>
Signed-off-by: Tuomas Tynkkynen <tuomas@tuxera.com>
---
 fs/9p/vfs_inode.c      | 3 +++
 fs/9p/vfs_inode_dotl.c | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 2a5de610dd8f..bdabb2765d1b 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -483,6 +483,9 @@ static int v9fs_test_inode(struct inode *inode, void *data)
 
 	if (v9inode->qid.type != st->qid.type)
 		return 0;
+
+	if (v9inode->qid.path != st->qid.path)
+		return 0;
 	return 1;
 }
 
diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index 70f9887c59a9..7f6ae21a27b3 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -87,6 +87,9 @@ static int v9fs_test_inode_dotl(struct inode *inode, void *data)
 
 	if (v9inode->qid.type != st->qid.type)
 		return 0;
+
+	if (v9inode->qid.path != st->qid.path)
+		return 0;
 	return 1;
 }
 
-- 
2.13.0

  reply	other threads:[~2017-09-06 15:10 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-09-06 14:59 [PATCH 0/2] 9p: Fixes for hard-to-hit bugs Tuomas Tynkkynen
2017-09-06 14:59 ` Tuomas Tynkkynen [this message]
2017-09-06 14:59 ` [PATCH 2/2] net/9p: Switch to wait_event_killable() Tuomas Tynkkynen
2017-09-07 14:49 ` [PATCH 0/2] 9p: Fixes for hard-to-hit bugs Latchesar Ionkov
2017-09-26 13:10 ` Tuomas Tynkkynen
2017-10-20 20:11   ` Al Viro
2017-10-24  1:41     ` Tuomas Tynkkynen
2017-10-24  2:11       ` Al Viro
2017-10-20 12:34 ` Tuomas Tynkkynen
2017-10-20 19:40   ` Linus Torvalds

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170906145908.8082-2-tuomas@tuxera.com \
    --to=tuomas@tuxera.com \
    --cc=davem@davemloft.net \
    --cc=ericvh@gmail.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lucho@ionkov.net \
    --cc=netdev@vger.kernel.org \
    --cc=rminnich@sandia.gov \
    --cc=stable@vger.kernel.org \
    --cc=v9fs-developer@lists.sourceforge.net \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).