diff options
| author | Konstantin Khlebnikov <khlebnikov@yandex-team.ru> | 2015-11-16 18:44:11 +0300 |
|---|---|---|
| committer | Sasha Levin <sasha.levin@oracle.com> | 2016-02-02 13:56:03 -0500 |
| commit | 82359171a3187e5f44d842f33547698c0e364ad5 (patch) | |
| tree | 3868b0f310902ccdae5789d2dc5f735abbc886c4 /fs | |
| parent | b41e08cbe451009d610d52f2c2c687298e791e63 (diff) | |
| download | lwn-82359171a3187e5f44d842f33547698c0e364ad5.tar.gz lwn-82359171a3187e5f44d842f33547698c0e364ad5.zip | |
ovl: check dentry positiveness in ovl_cleanup_whiteouts()
[ Upstream commit 84889d49335627bc770b32787c1ef9ebad1da232 ]
This patch fixes kernel crash at removing directory which contains
whiteouts from lower layers.
Cache of directory content passed as "list" contains entries from all
layers, including whiteouts from lower layers. So, lookup in upper dir
(moved into work at this stage) will return negative entry. Plus this
cache is filled long before and we can race with external removal.
Example:
mkdir -p lower0/dir lower1/dir upper work overlay
touch lower0/dir/a lower0/dir/b
mknod lower1/dir/a c 0 0
mount -t overlay none overlay -o lowerdir=lower1:lower0,upperdir=upper,workdir=work
rm -fr overlay/dir
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Cc: <stable@vger.kernel.org> # 3.18+
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/overlayfs/readdir.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c index ab1e3dcbed95..c55dc5588b17 100644 --- a/fs/overlayfs/readdir.c +++ b/fs/overlayfs/readdir.c @@ -579,7 +579,8 @@ void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list) (int) PTR_ERR(dentry)); continue; } - ovl_cleanup(upper->d_inode, dentry); + if (dentry->d_inode) + ovl_cleanup(upper->d_inode, dentry); dput(dentry); } mutex_unlock(&upper->d_inode->i_mutex); |