Commit 3b821409 authored Feb 23, 2018 by Al Viro

lock_parent() needs to recheck if dentry got __dentry_kill'ed under it



In case when dentry passed to lock_parent() is protected from freeing only
by the fact that it's on a shrink list and trylock of parent fails, we
could get hit by __dentry_kill() (and subsequent dentry_kill(parent))
between unlocking dentry and locking presumed parent.  We need to recheck
that dentry is alive once we lock both it and parent *and* postpone
rcu_read_unlock() until after that point.  Otherwise we could return
a pointer to struct dentry that already is rcu-scheduled for freeing, with
->d_lock held on it; caller's subsequent attempt to unlock it can end
up with memory corruption.

Cc: stable@vger.kernel.org # 3.12+, counting backports
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

parent 91ab883e

fs/dcache.c

+8 −3

Original line number	Diff line number	Diff line
		@@ -647,11 +647,16 @@ again:
		spin_unlock(&parent->d_lock);
		goto again;
		}
		rcu_read_unlock();
		if (parent != dentry)
		if (parent != dentry) {
		spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
		else
		if (unlikely(dentry->d_lockref.count < 0)) {
		spin_unlock(&parent->d_lock);
		parent = NULL;
		}
		} else {
		parent = NULL;
		}
		rcu_read_unlock();
		return parent;
		}

Admin message