namei: check for removed names in LOOKUP_REVAL walks

Unlinking a mountpoint lets a path walk with LOOKUP_REVAL open the file
that the mounts covered.

A refwalk must not step onto a dentry that was unlinked after the walk
found it, since the unlink has detached the mounts that covered it.
unlink_may_reveal() skips this check when LOOKUP_REVAL is set, and any
-ESTALE from an earlier component starts a walk with that flag, such as
one that a FUSE server returns from ->lookup().

Opening a covered file through a path whose FUSE component first fails
with -ESTALE, while the name of the file is unlinked, read the contents
of the covered file.

Fix this by making the check in every refwalk and by repeating the walk
when the attempt with LOOKUP_REVAL fails it.

Fixes: 8189ab688f5a ("namei: don't reveal overmounted entries in refwalk")
Signed-off-by: Chris Mason <mason@kernel.org>
Link: https://patch.msgid.link/20261011161843.11360-1-mason@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

0 files changed, 0 insertions, 0 deletions