linux-kernel - [PATCH 5.15.y 1/2] udf_rename(): only access the child content on cross-directory rename

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251125110638.15758-2-hsukrut3@gmail.com>
Date: Tue, 25 Nov 2025 16:36:36 +0530
From: Sukrut Heroorkar <hsukrut3@...il.com>
To: Jan Kara <jack@...e.com>,
	linux-kernel@...r.kernel.org (open list)
Cc: shuah@...nel.org,
	david.hunter.linux@...il.com,
	Al Viro <viro@...iv.linux.org.uk>,
	Jan Kara <jack@...e.cz>,
	Sukrut Heroorkar <hsukrut3@...il.com>
Subject: [PATCH 5.15.y 1/2] udf_rename(): only access the child content on cross-directory rename

From: Al Viro <viro@...iv.linux.org.uk>

[ Upstream commit 9d35cebb794bb7be93db76c3383979c7deacfef9 ]

We can't really afford locking the source on same-directory rename;
currently vfs_rename() tries to do that, but it will have to be
changed.  The logics in udf_rename() is lazy and goes looking for
".." in source even in same-directory case.  It's not hard to get
rid of that, leaving that behaviour only for cross-directory case;
that VFS can get locks safely (and will keep doing that after the
coming changes).

Reviewed-by: Jan Kara <jack@...e.cz>
Signed-off-by: Al Viro <viro@...iv.linux.org.uk>
Stable-dep-of: 6756af923e06 ("udf: Verify inode link counts before performing rename")
Signed-off-by: Sukrut Heroorkar <hsukrut3@...il.com>
---
 fs/udf/namei.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index 5e39cbc74524..f4aded54a994 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -751,7 +751,7 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
 	struct inode *old_inode = d_inode(old_dentry);
 	struct inode *new_inode = d_inode(new_dentry);
 	struct udf_fileident_iter oiter, niter, diriter;
-	bool has_diriter = false;
+	bool has_diriter = false, is_dir = false;
 	int retval;
 	struct kernel_lb_addr tloc;
 
@@ -774,6 +774,9 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
 			if (!empty_dir(new_inode))
 				goto out_oiter;
 		}
+		is_dir = true;
+	}
+	if (is_dir && old_dir != new_dir) {
 		retval = udf_fiiter_find_entry(old_inode, &dotdot_name,
 					       &diriter);
 		if (retval == -ENOENT) {
@@ -859,7 +862,9 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
 					cpu_to_lelb(UDF_I(new_dir)->i_location);
 		udf_fiiter_write_fi(&diriter, NULL);
 		udf_fiiter_release(&diriter);
+	}
 
+	if (is_dir) {
 		inode_dec_link_count(old_dir);
 		if (new_inode)
 			inode_dec_link_count(new_inode);
-- 
2.43.0