From: Chen Zhongjin Date: Mon, 28 Nov 2022 10:33:05 +0000 (+0100) Subject: ovl: fix use inode directly in rcu-walk mode X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=672e4268b2863d7e4978dfed29552b31c2f9bd4e;p=linux.git ovl: fix use inode directly in rcu-walk mode ovl_dentry_revalidate_common() can be called in rcu-walk mode. As document said, "in rcu-walk mode, d_parent and d_inode should not be used without care". Check inode here to protect access under rcu-walk mode. Fixes: bccece1ead36 ("ovl: allow remote upper") Reported-and-tested-by: syzbot+a4055c78774bbf3498bb@syzkaller.appspotmail.com Signed-off-by: Chen Zhongjin Cc: # v5.7 Signed-off-by: Miklos Szeredi --- diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c index a29a8afe9b262..3d14a3f1465d1 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -139,11 +139,16 @@ static int ovl_dentry_revalidate_common(struct dentry *dentry, unsigned int flags, bool weak) { struct ovl_entry *oe = dentry->d_fsdata; + struct inode *inode = d_inode_rcu(dentry); struct dentry *upper; unsigned int i; int ret = 1; - upper = ovl_dentry_upper(dentry); + /* Careful in RCU mode */ + if (!inode) + return -ECHILD; + + upper = ovl_i_dentry_upper(inode); if (upper) ret = ovl_revalidate_real(upper, flags, weak);