Commit b12cea91 authored by Al Viro's avatar Al Viro
Browse files

change the locking order for namespace_sem 



Have it nested inside ->i_mutex.  Instead of using follow_down()
under namespace_sem, followed by grabbing i_mutex and checking that
mountpoint to be is not dead, do the following:
	grab i_mutex
	check that it's not dead
	grab namespace_sem
	see if anything is mounted there
	if not, we've won
	otherwise
		drop locks
		put_path on what we had
		replace with what's mounted
		retry everything with new mountpoint to be

New helper (lock_mount()) does that.  do_add_mount(), do_move_mount(),
do_loopback() and pivot_root() switched to it; in case of the last
two that eliminates a race we used to have - original code didn't
do follow_down().

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 27cb1572

fs/namespace.c

+73 −60
Original line number Diff line number Diff line
@@ -1663,9 +1663,35 @@ static int attach_recursive_mnt(struct vfsmount *source_mnt, 
	return err;

}



static int lock_mount(struct path *path)

{

	struct vfsmount *mnt;

retry:

	mutex_lock(&path->dentry->d_inode->i_mutex);

	if (unlikely(cant_mount(path->dentry))) {

		mutex_unlock(&path->dentry->d_inode->i_mutex);

		return -ENOENT;

	}

	down_write(&namespace_sem);

	mnt = lookup_mnt(path);

	if (likely(!mnt))

		return 0;

	up_write(&namespace_sem);

	mutex_unlock(&path->dentry->d_inode->i_mutex);

	path_put(path);

	path->mnt = mnt;

	path->dentry = dget(mnt->mnt_root);

	goto retry;

}



static void unlock_mount(struct path *path)

{

	up_write(&namespace_sem);

	mutex_unlock(&path->dentry->d_inode->i_mutex);

}



static int graft_tree(struct vfsmount *mnt, struct path *path)

{

	int err;

	if (mnt->mnt_sb->s_flags & MS_NOUSER)

		return -EINVAL;
@@ -1673,16 +1699,10 @@ static int graft_tree(struct vfsmount *mnt, struct path *path) 
	      S_ISDIR(mnt->mnt_root->d_inode->i_mode))

		return -ENOTDIR;



	err = -ENOENT;

	mutex_lock(&path->dentry->d_inode->i_mutex);

	if (cant_mount(path->dentry))

		goto out_unlock;

	if (d_unlinked(path->dentry))

		return -ENOENT;



	if (!d_unlinked(path->dentry))

		err = attach_recursive_mnt(mnt, path, NULL);

out_unlock:

	mutex_unlock(&path->dentry->d_inode->i_mutex);

	return err;

	return attach_recursive_mnt(mnt, path, NULL);

}



/*
@@ -1745,6 +1765,7 @@ static int do_change_type(struct path *path, int flag) 
static int do_loopback(struct path *path, char *old_name,

				int recurse)

{

	LIST_HEAD(umount_list);

	struct path old_path;

	struct vfsmount *mnt = NULL;

	int err = mount_is_safe(path);
@@ -1756,13 +1777,16 @@ static int do_loopback(struct path *path, char *old_name, 
	if (err)

		return err;



	down_write(&namespace_sem);

	err = lock_mount(path);

	if (err)

		goto out;



	err = -EINVAL;

	if (IS_MNT_UNBINDABLE(old_path.mnt))

		goto out;

		goto out2;



	if (!check_mnt(path->mnt) || !check_mnt(old_path.mnt))

		goto out;

		goto out2;



	err = -ENOMEM;

	if (recurse)
@@ -1771,20 +1795,18 @@ static int do_loopback(struct path *path, char *old_name, 
		mnt = clone_mnt(old_path.mnt, old_path.dentry, 0);



	if (!mnt)

		goto out;

		goto out2;



	err = graft_tree(mnt, path);

	if (err) {

		LIST_HEAD(umount_list);



		br_write_lock(vfsmount_lock);

		umount_tree(mnt, 0, &umount_list);

		br_write_unlock(vfsmount_lock);

		release_mounts(&umount_list);

	}



out2:

	unlock_mount(path);

	release_mounts(&umount_list);

out:

	up_write(&namespace_sem);

	path_put(&old_path);

	return err;

}
@@ -1873,18 +1895,12 @@ static int do_move_mount(struct path *path, char *old_name) 
	if (err)

		return err;



	down_write(&namespace_sem);

	err = follow_down(path, true);

	err = lock_mount(path);

	if (err < 0)

		goto out;



	err = -EINVAL;

	if (!check_mnt(path->mnt) || !check_mnt(old_path.mnt))

		goto out;



	err = -ENOENT;

	mutex_lock(&path->dentry->d_inode->i_mutex);

	if (cant_mount(path->dentry))

		goto out1;



	if (d_unlinked(path->dentry))
@@ -1926,9 +1942,8 @@ static int do_move_mount(struct path *path, char *old_name) 
	 * automatically */

	list_del_init(&old_path.mnt->mnt_expire);

out1:

	mutex_unlock(&path->dentry->d_inode->i_mutex);

	unlock_mount(path);

out:

	up_write(&namespace_sem);

	if (!err)

		path_put(&parent_path);

	path_put(&old_path);
@@ -1983,11 +1998,9 @@ static int do_add_mount(struct vfsmount *newmnt, struct path *path, int mnt_flag 


	mnt_flags &= ~(MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL);



	down_write(&namespace_sem);

	/* Something was mounted here while we slept */

	err = follow_down(path, true);

	if (err < 0)

		goto unlock;

	err = lock_mount(path);

	if (err)

		return err;



	err = -EINVAL;

	if (!(mnt_flags & MNT_SHRINKABLE) && !check_mnt(path->mnt))
@@ -2007,7 +2020,7 @@ static int do_add_mount(struct vfsmount *newmnt, struct path *path, int mnt_flag 
	err = graft_tree(newmnt, path);



unlock:

	up_write(&namespace_sem);

	unlock_mount(path);

	return err;

}
@@ -2575,55 +2588,53 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root, 
		goto out1;



	error = security_sb_pivotroot(&old, &new);

	if (error) {

		path_put(&old);

		goto out1;

	}

	if (error)

		goto out2;



	get_fs_root(current->fs, &root);

	down_write(&namespace_sem);

	mutex_lock(&old.dentry->d_inode->i_mutex);

	error = lock_mount(&old);

	if (error)

		goto out3;



	error = -EINVAL;

	if (IS_MNT_SHARED(old.mnt) ||

		IS_MNT_SHARED(new.mnt->mnt_parent) ||

		IS_MNT_SHARED(root.mnt->mnt_parent))

		goto out2;

		goto out4;

	if (!check_mnt(root.mnt) || !check_mnt(new.mnt))

		goto out2;

		goto out4;

	error = -ENOENT;

	if (cant_mount(old.dentry))

		goto out2;

	if (d_unlinked(new.dentry))

		goto out2;

		goto out4;

	if (d_unlinked(old.dentry))

		goto out2;

		goto out4;

	error = -EBUSY;

	if (new.mnt == root.mnt ||

	    old.mnt == root.mnt)

		goto out2; /* loop, on the same file system  */

		goto out4; /* loop, on the same file system  */

	error = -EINVAL;

	if (root.mnt->mnt_root != root.dentry)

		goto out2; /* not a mountpoint */

		goto out4; /* not a mountpoint */

	if (root.mnt->mnt_parent == root.mnt)

		goto out2; /* not attached */

		goto out4; /* not attached */

	if (new.mnt->mnt_root != new.dentry)

		goto out2; /* not a mountpoint */

		goto out4; /* not a mountpoint */

	if (new.mnt->mnt_parent == new.mnt)

		goto out2; /* not attached */

		goto out4; /* not attached */

	/* make sure we can reach put_old from new_root */

	tmp = old.mnt;

	if (tmp != new.mnt) {

		for (;;) {

			if (tmp->mnt_parent == tmp)

				goto out2; /* already mounted on put_old */

				goto out4; /* already mounted on put_old */

			if (tmp->mnt_parent == new.mnt)

				break;

			tmp = tmp->mnt_parent;

		}

		if (!is_subdir(tmp->mnt_mountpoint, new.dentry))

			goto out2;

			goto out4;

	} else if (!is_subdir(old.dentry, new.dentry))

		goto out2;

		goto out4;

	br_write_lock(vfsmount_lock);

	detach_mnt(new.mnt, &parent_path);

	detach_mnt(root.mnt, &root_parent);
@@ -2634,14 +2645,16 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root, 
	touch_mnt_namespace(current->nsproxy->mnt_ns);

	br_write_unlock(vfsmount_lock);

	chroot_fs_refs(&root, &new);



	error = 0;

out4:

	unlock_mount(&old);

	if (!error) {

		path_put(&root_parent);

		path_put(&parent_path);

out2:

	mutex_unlock(&old.dentry->d_inode->i_mutex);

	up_write(&namespace_sem);

	}

out3:

	path_put(&root);

out2:

	path_put(&old);

out1:

	path_put(&new);

CRA Git | Maintained and supported by SUSTech CRA and CCSE