linux-kernel - Re: [PATCH 4/6] fs: dcache locking for exlusion between overlayfs, casefolding

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <mhjalo2m6rco2czfafjwy5bdw7lguqa6pfwhsesor5czofo3iu@o3tnjzcawjjf>
Date: Tue, 20 May 2025 11:27:38 -0400
From: Kent Overstreet <kent.overstreet@...ux.dev>
To: Al Viro <viro@...iv.linux.org.uk>
Cc: linux-fsdevel@...r.kernel.org, linux-bcachefs@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-unionfs@...r.kernel.org, 
	Miklos Szeredi <miklos@...redi.hu>, Amir Goldstein <amir73il@...il.com>, 
	Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>
Subject: Re: [PATCH 4/6] fs: dcache locking for exlusion between overlayfs,
 casefolding

On Tue, May 20, 2025 at 04:25:36PM +0100, Al Viro wrote:
> On Tue, May 20, 2025 at 01:15:56AM -0400, Kent Overstreet wrote:
> 
> > +int d_casefold_enable(struct dentry *dentry, struct d_casefold_enable *e)
> > +{
> > +	struct dentry *root = dentry->d_sb->s_root;
> > +	int ret = 0;
> > +
> > +	guard(mutex)(&no_casefold_dentries_lock);
> > +
> > +	for (struct dentry *i = dentry;
> > +	     i && i->d_inode->i_flags & S_NO_CASEFOLD;
> > +	     i = i != root ? i->d_parent : NULL) {
> > +		ret = darray_push(&e->refs, i);
> > +		if (ret)
> > +			goto err;
> > +
> > +		ret = no_casefold_dentry_get(i, ref_casefold_enable);
> 
> 	Beyond being fucking ugly, this is outright broken.  Lose
> the timeslice (e.g. on allocation in that thing), and there's
> nothing to prevent your 'i' from pointing to freed memory.

I was under the impression that dentries couldn't be freed while a child
is pinned, and we have a dget() on the start of the chain.

But no, rename would break that, of course.