linux-stable

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-10 07:00:48 +00:00

History

Miklos Szeredi 9b91b6b019 ovl: fix deadlock in splice write

There's possibility of an ABBA deadlock in case of a splice write to an
overlayfs file and a concurrent splice write to a corresponding real file.

The call chain for splice to an overlay file:

 -> do_splice                     [takes sb_writers on overlay file]
   -> do_splice_from
     -> iter_file_splice_write    [takes pipe->mutex]
       -> vfs_iter_write
         ...
         -> ovl_write_iter        [takes sb_writers on real file]

And the call chain for splice to a real file:

 -> do_splice                     [takes sb_writers on real file]
   -> do_splice_from
     -> iter_file_splice_write    [takes pipe->mutex]

Syzbot successfully bisected this to commit 82a763e61e2b ("ovl: simplify
file splice").

Fix by reverting the write part of the above commit and by adding missing
bits from ovl_write_iter() into ovl_splice_write().

Fixes: 82a763e61e2b ("ovl: simplify file splice")
Reported-and-tested-by: syzbot+579885d1a9a833336209@syzkaller.appspotmail.com
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

2021-08-10 10:21:30 +02:00

copy_up.c

ovl: fix missing revert_creds() on error path

2021-04-12 12:00:36 +02:00

dir.c

ovl: stack fileattr ops

2021-04-12 15:04:29 +02:00

export.c

ovl: propagate ovl_fs to ovl_decode_real_fh and ovl_encode_real_fh

2020-11-12 11:31:55 +01:00

file.c

ovl: fix deadlock in splice write