diff options
| author | Miklos Szeredi <mszeredi@redhat.com> | 2016-08-03 13:44:27 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-08-10 11:49:30 +0200 |
| commit | 8e510cd92199e863bd457f6b56ad85e00dfb3cb3 (patch) | |
| tree | 72e26cc11b0a252f8679253082d2ce19f3db3407 | |
| parent | 33f9cff6ec2fbfcf0b40d4328d292c745185fdf4 (diff) | |
vfs: fix deadlock in file_remove_privs() on overlayfs
commit c1892c37769cf89c7e7ba57528ae2ccb5d153c9b upstream.
file_remove_privs() is called with inode lock on file_inode(), which
proceeds to calling notify_change() on file->f_path.dentry. Which triggers
the WARN_ON_ONCE(!inode_is_locked(inode)) in addition to deadlocking later
when ovl_setattr tries to lock the underlying inode again.
Fix this mess by not mixing the layers, but doing everything on underlying
dentry/inode.
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes: 07a2daab49c5 ("ovl: Copy up underlying inode's ->i_mode to overlay inode")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/inode.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/inode.c b/fs/inode.c index 1be5f9003eb3..b0edef500590 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -1733,8 +1733,8 @@ static int __remove_privs(struct dentry *dentry, int kill) */ int file_remove_privs(struct file *file) { - struct dentry *dentry = file->f_path.dentry; - struct inode *inode = d_inode(dentry); + struct dentry *dentry = file_dentry(file); + struct inode *inode = file_inode(file); int kill; int error = 0; @@ -1742,7 +1742,7 @@ int file_remove_privs(struct file *file) if (IS_NOSEC(inode)) return 0; - kill = file_needs_remove_privs(file); + kill = dentry_needs_remove_privs(dentry); if (kill < 0) return kill; if (kill) |