linux-kernel - Re: [patch 4/4] nfs: clean up sillyrenaming in nfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87bphk85me.fsf@devron.myhome.or.jp>
Date:	Mon, 28 Dec 2009 06:32:57 +0900
From:	OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>
To:	Trond.Myklebust@...app.com
Cc:	Miklos Szeredi <miklos@...redi.hu>, akpm@...ux-foundation.org,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [patch 4/4] nfs: clean up sillyrenaming in nfs_rename()

Miklos Szeredi <miklos@...redi.hu> writes:

> --- linux-2.6.orig/fs/nfs/dir.c	2009-12-02 15:11:19.000000000 +0100
> +++ linux-2.6/fs/nfs/dir.c	2009-12-02 15:11:30.000000000 +0100
> @@ -1611,14 +1611,11 @@ static int nfs_rename(struct inode *old_
>  
>  			/* silly-rename the existing target ... */
>  			err = nfs_sillyrename(new_dir, new_dentry);
> -			if (!err) {
> -				new_dentry = rehash = dentry;
> -				new_inode = NULL;
> -				/* instantiate the replacement target */
> -				d_instantiate(new_dentry, NULL);
> -			} else if (atomic_read(&new_dentry->d_count) > 1)
> -				/* dentry still busy? */
> +			if (err)
>  				goto out;
> +
> +			new_dentry = dentry;
> +			new_inode = NULL;

This needs to update "rehash". Sorry, this patch is still compile test
only, although the patch is clear and simple.

Thanks.
-- 
OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>



[PATCH] nfs: Fix d_rehash() for hashed dentry in nfs_rename()

Recent change is missing to update "rehash". With that change, it will
become the cause of adding dentry to hash twice.

This explains the reason of Oops (dereference the freed dentry in
__d_lookup()) on my machine.

Signed-off-by: OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>
---

 fs/nfs/dir.c |    1 +
 1 file changed, 1 insertion(+)

diff -puN fs/nfs/dir.c~nfs-d_rehash-fix fs/nfs/dir.c
--- linux-2.6/fs/nfs/dir.c~nfs-d_rehash-fix	2009-12-28 06:18:09.000000000 +0900
+++ linux-2.6-hirofumi/fs/nfs/dir.c	2009-12-28 06:18:16.000000000 +0900
@@ -1615,6 +1615,7 @@ static int nfs_rename(struct inode *old_
 				goto out;
 
 			new_dentry = dentry;
+			rehash = NULL;
 			new_inode = NULL;
 		}
 	}
_
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/