diff options
| author | Amir Goldstein <amir73il@gmail.com> | 2023-12-17 12:08:52 +0300 |
|---|---|---|
| committer | Amir Goldstein <amir73il@gmail.com> | 2023-12-17 14:33:46 +0300 |
| commit | 413ba91089c74207313b315e04cf381ffb5b20e4 (patch) | |
| tree | 499a5b5981938128ec76af69a1394f5d1a87e33d /fs | |
| parent | 98b1cc82c4affc16f5598d4fa14b1858671b2263 (diff) | |
| download | linux-413ba91089c74207313b315e04cf381ffb5b20e4.tar.xz | |
ovl: fix dentry reference leak after changes to underlying layers
syzbot excercised the forbidden practice of moving the workdir under
lowerdir while overlayfs is mounted and tripped a dentry reference leak.
Fixes: c63e56a4a652 ("ovl: do not open/llseek lower file with upper sb_writers held")
Reported-and-tested-by: syzbot+8608bb4553edb8c78f41@syzkaller.appspotmail.com
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/overlayfs/copy_up.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c index 4382881b0709..8bea66c97316 100644 --- a/fs/overlayfs/copy_up.c +++ b/fs/overlayfs/copy_up.c @@ -753,15 +753,16 @@ static int ovl_copy_up_workdir(struct ovl_copy_up_ctx *c) path.dentry = temp; err = ovl_copy_up_data(c, &path); /* - * We cannot hold lock_rename() throughout this helper, because or + * We cannot hold lock_rename() throughout this helper, because of * lock ordering with sb_writers, which shouldn't be held when calling * ovl_copy_up_data(), so lock workdir and destdir and make sure that * temp wasn't moved before copy up completion or cleanup. - * If temp was moved, abort without the cleanup. */ ovl_start_write(c->dentry); if (lock_rename(c->workdir, c->destdir) != NULL || temp->d_parent != c->workdir) { + /* temp or workdir moved underneath us? abort without cleanup */ + dput(temp); err = -EIO; goto unlock; } else if (err) { |