linux-kernel - [PATCH] nlookup missing decrement in fuse_direntplus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <202308110712.37B7CIwo078462@mse-fl2.zte.com.cn>
Date:   Fri, 11 Aug 2023 14:45:00 +0800 (CST)
From:   <ruan.meisi@....com.cn>
To:     <miklos@...redi.hu>
Cc:     <linux-fsdevel@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject:  [PATCH] nlookup missing decrement in fuse_direntplus_link

>From 53aad83672123dbe01bcef9f9026becc4e93ee9f Mon Sep 17 00:00:00 2001
From: ruanmeisi <ruan.meisi@....com.cn>
Date: Tue, 25 Apr 2023 19:13:54 +0800
Subject: [PATCH] nlookup missing decrement in fuse_direntplus_link

During our debugging of glusterfs, we found an Assertion
failed error: inode_lookup >= nlookup, which was caused by the
nlookup value in the kernel being greater than that in the FUSE
file system.The issue was introduced by fuse_direntplus_link,
where in the function, fuse_iget increments nlookup, and if
d_splice_alias returns failure, fuse_direntplus_link returns
failure without decrementing nlookup
https://github.com/gluster/glusterfs/pull/4081

Signed-off-by: ruanmeisi <ruan.meisi@....com.cn>
---
 fs/fuse/readdir.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/fuse/readdir.c b/fs/fuse/readdir.c
index dc603479b30e..b3d498163f97 100644
--- a/fs/fuse/readdir.c
+++ b/fs/fuse/readdir.c
@@ -243,8 +243,16 @@ static int fuse_direntplus_link(struct file *file,
 			dput(dentry);
 			dentry = alias;
 		}
-		if (IS_ERR(dentry))
+		if (IS_ERR(dentry)) {
+			if (!IS_ERR(inode)) {
+				struct fuse_inode *fi = get_fuse_inode(inode);
+
+				spin_lock(&fi->lock);
+				fi->nlookup--;
+				spin_unlock(&fi->lock);
+			}
 			return PTR_ERR(dentry);
+		}
 	}
 	if (fc->readdirplus_auto)
 		set_bit(FUSE_I_INIT_RDPLUS, &get_fuse_inode(inode)->state);
-- 
2.27.0