proc: Use nd_jump_link in proc_ns_follow_link (db04dc67) · Commits · 戴 / test

Update proc_ns_follow_link to use nd_jump_link instead of just manually updating nd.path.dentry. This fixes the BUG_ON(nd->inode != parent->d_inode) reported by Dave Jones and reproduced trivially with mkdir /proc/self/ns/uts/a. Sigh it looks like the VFS change to require use of nd_jump_link happend while proc_ns_follow_link was baking and since the common case of proc_ns_follow_link continued to work without problems the need for making this change was overlooked. Cc: stable@vger.kernel.org Signed-off-by:

"Eric W. Biederman" <ebiederm@xmission.com>

fs/proc/namespaces.c

+6 −6

Original line number	Diff line number	Diff line
		@@ -118,7 +118,7 @@ static void proc_ns_follow_link(struct dentry dentry, struct nameidata *nd)
		struct super_block *sb = inode->i_sb;
		struct proc_inode *ei = PROC_I(inode);
		struct task_struct *task;
		struct dentry *ns_dentry;
		struct path ns_path;
		void *error = ERR_PTR(-EACCES);

		task = get_proc_task(inode);
		@@ -128,14 +128,14 @@ static void proc_ns_follow_link(struct dentry dentry, struct nameidata *nd)
		if (!ptrace_may_access(task, PTRACE_MODE_READ))
		goto out_put_task;

		ns_dentry = proc_ns_get_dentry(sb, task, ei->ns_ops);
		if (IS_ERR(ns_dentry)) {
		error = ERR_CAST(ns_dentry);
		ns_path.dentry = proc_ns_get_dentry(sb, task, ei->ns_ops);
		if (IS_ERR(ns_path.dentry)) {
		error = ERR_CAST(ns_path.dentry);
		goto out_put_task;
		}

		dput(nd->path.dentry);
		nd->path.dentry = ns_dentry;
		ns_path.mnt = mntget(nd->path.mnt);
		nd_jump_link(nd, &ns_path);
		error = NULL;

		out_put_task:

Admin message