udf: Protect rename against modification of moved directory

When we are renaming a directory to a different directory, we need to
update '..' entry in the moved directory. However nothing prevents moved
directory from being modified and even converted from the in-ICB format
to the normal format which results in a crash. Fix the problem by
locking the moved directory.

Reported-by: syzbot+aebf90eea2671c43112a@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>

diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index 87257f49b5da192e7c14cd4c13a838eb9b87de14..663b66014c98eb83e235c50cb9d97c99826a1daf 100644 (file)
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -786,6 +786,11 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
                        if (!empty_dir(new_inode))
                                goto out_oiter;
                }
+               /*
+                * We need to protect against old_inode getting converted from
+                * ICB to normal directory.
+                */
+               inode_lock_nested(old_inode, I_MUTEX_NONDIR2);
                retval = udf_fiiter_find_entry(old_inode, &dotdot_name,
                                               &diriter);
                if (retval == -ENOENT) {
@@ -794,8 +799,10 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
                                old_inode->i_ino);
                        retval = -EFSCORRUPTED;
                }
-               if (retval)
+               if (retval) {
+                       inode_unlock(old_inode);
                        goto out_oiter;
+               }
                has_diriter = true;
                tloc = lelb_to_cpu(diriter.fi.icb.extLocation);
                if (udf_get_lb_pblock(old_inode->i_sb, &tloc, 0) !=
@@ -873,6 +880,7 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
                               udf_dir_entry_len(&diriter.fi));
                udf_fiiter_write_fi(&diriter, NULL);
                udf_fiiter_release(&diriter);
+               inode_unlock(old_inode);
 
                inode_dec_link_count(old_dir);
                if (new_inode)
@@ -884,8 +892,10 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
        }
        return 0;
 out_oiter:
-       if (has_diriter)
+       if (has_diriter) {
                udf_fiiter_release(&diriter);
+               inode_unlock(old_inode);
+       }
        udf_fiiter_release(&oiter);
 
        return retval;