linux-kernel - [PATCH v2] fs: simplify misleading code to remove ambiguity regarding ihold()/iput()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 28 Sep 2023 16:23:41 +0100
From:   Luís Henriques <lhenriques@...e.de>
To:     Alexander Viro <viro@...iv.linux.org.uk>,
        Christian Brauner <brauner@...nel.org>,
        David Howells <dhowells@...hat.com>
Cc:     Mateusz Guzik <mjguzik@...il.com>, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Luís Henriques <lhenriques@...e.de>
Subject: [PATCH v2] fs: simplify misleading code to remove ambiguity regarding ihold()/iput()

Because 'inode' is being initialised before checking if 'dentry' is negative
it looks like an extra iput() on 'inode' may happen since the ihold() is
done only if the dentry is *not* negative.  In reality this doesn't happen
because d_is_negative() is never true if ->d_inode is NULL.  This patch only
makes the code easier to understand, as I was initially mislead by it.

Fixes: b18825a7c8e3 ("VFS: Put a small type field into struct dentry::d_flags")
Signed-off-by: Luís Henriques <lhenriques@...e.de>
---
Changes since v1:
Rephrased commit message to make it clear there isn't a real bug

 fs/namei.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/fs/namei.c b/fs/namei.c
index 567ee547492b..156a570d7831 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -4386,11 +4386,9 @@ int do_unlinkat(int dfd, struct filename *name)
 	if (!IS_ERR(dentry)) {
 
 		/* Why not before? Because we want correct error value */
-		if (last.name[last.len])
+		if (last.name[last.len] || d_is_negative(dentry))
 			goto slashes;
 		inode = dentry->d_inode;
-		if (d_is_negative(dentry))
-			goto slashes;
 		ihold(inode);
 		error = security_path_unlink(&path, dentry);
 		if (error)