Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-07 13:43:51 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

udf: Protect rename against modification of moved directory

Browse Source 
When we are renaming a directory to a different directory, we need to
update '..' entry in the moved directory. However nothing prevents moved
directory from being modified and even converted from the in-ICB format
to the normal format which results in a crash. Fix the problem by
locking the moved directory.

Reported-by: syzbot+aebf90eea2671c43112a@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
This commit is contained in:
Jan Kara 2023-01-18 19:42:35 +01:00
parent 32f123a3f3
commit f950fd0529
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
fs/udf/namei.c
View File

@ -786,6 +786,11 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
if (!empty_dir(new_inode))
goto out_oiter;
}
/*
* We need to protect against old_inode getting converted from
* ICB to normal directory.
*/
inode_lock_nested(old_inode, I_MUTEX_NONDIR2);
retval = udf_fiiter_find_entry(old_inode, &dotdot_name,
&diriter);
if (retval == -ENOENT) {
@ -794,8 +799,10 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
old_inode->i_ino);
retval = -EFSCORRUPTED;
}
if (retval)
if (retval) {
inode_unlock(old_inode);
goto out_oiter;
}
has_diriter = true;
tloc = lelb_to_cpu(diriter.fi.icb.extLocation);
if (udf_get_lb_pblock(old_inode->i_sb, &tloc, 0) !=
@ -873,6 +880,7 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
udf_dir_entry_len(&diriter.fi));
udf_fiiter_write_fi(&diriter, NULL);
udf_fiiter_release(&diriter);
inode_unlock(old_inode);
inode_dec_link_count(old_dir);
if (new_inode)
@ -884,8 +892,10 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
}
return 0;
out_oiter:
if (has_diriter)
if (has_diriter) {
udf_fiiter_release(&diriter);
inode_unlock(old_inode);
}
udf_fiiter_release(&oiter);
return retval;