lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 29 Dec 2020 16:56:09 +0800 From: yangerkun <yangerkun@...wei.com> To: <linux-ext4@...r.kernel.org>, <tytso@....edu>, <adilger.kernel@...ger.ca>, <jack@...e.cz> CC: <yi.zhang@...wei.com>, <lihaotian9@...wei.com>, <lutianxiong@...wei.com>, <linfeilong@...wei.com>, <yangerkun@...wei.com> Subject: [PATCH] ext4: fix bug for rename with RENAME_WHITEOUT ext4_rename will create a special inode for whiteout and use this 'ino' to replace the source file's dir entry 'ino'. Once error happens latter(small ext4 img, and consume all space, so the rename with dst path not exist will fail due to the ENOSPC return from ext4_add_entry in ext4_rename), the cleanup do drop the nlink for whiteout, but forget to restore 'ino' with source file. This will lead to "deleted inode referenced". Signed-off-by: yangerkun <yangerkun@...wei.com> --- fs/ext4/namei.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index b17a082b7db1..0e89e5a0c758 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -3593,9 +3593,6 @@ static int ext4_setent(handle_t *handle, struct ext4_renament *ent, return retval2; } } - brelse(ent->bh); - ent->bh = NULL; - return retval; } @@ -3794,6 +3791,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, } } + old_file_type = old.de->file_type; if (IS_DIRSYNC(old.dir) || IS_DIRSYNC(new.dir)) ext4_handle_sync(handle); @@ -3821,7 +3819,6 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, force_reread = (new.dir->i_ino == old.dir->i_ino && ext4_test_inode_flag(new.dir, EXT4_INODE_INLINE_DATA)); - old_file_type = old.de->file_type; if (whiteout) { /* * Do this before adding a new entry, so the old entry is sure @@ -3919,15 +3916,18 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, retval = 0; end_rename: - brelse(old.dir_bh); - brelse(old.bh); - brelse(new.bh); if (whiteout) { + ext4_setent(handle, &old, + old.inode->i_ino, old_file_type); if (retval) drop_nlink(whiteout); unlock_new_inode(whiteout); iput(whiteout); + } + brelse(old.dir_bh); + brelse(old.bh); + brelse(new.bh); if (handle) ext4_journal_stop(handle); return retval; -- 2.25.4
Powered by blists - more mailing lists