[RHEL7,COMMIT] ms/lock_parent() needs to recheck if dentry got __dentry_kill'ed under it

Submitted by Konstantin Khorenko on July 1, 2019, 9:37 a.m.


Message ID 201907010937.x619bHDL032686@finist-ce7.sw.ru
State New
Series "Series without cover letter"
Headers show

Commit Message

Konstantin Khorenko July 1, 2019, 9:37 a.m.
The commit is pushed to "branch-rh7-3.10.0-957.21.3.vz7.106.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-957.21.3.vz7.106.3
commit cde8824cd98d22fa90d6f97b65562af447712ab7
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Mon Jul 1 12:37:17 2019 +0300

    ms/lock_parent() needs to recheck if dentry got __dentry_kill'ed under it
    In case when dentry passed to lock_parent() is protected from freeing only
    by the fact that it's on a shrink list and trylock of parent fails, we
    could get hit by __dentry_kill() (and subsequent dentry_kill(parent))
    between unlocking dentry and locking presumed parent.  We need to recheck
    that dentry is alive once we lock both it and parent *and* postpone
    rcu_read_unlock() until after that point.  Otherwise we could return
    a pointer to struct dentry that already is rcu-scheduled for freeing, with
    ->d_lock held on it; caller's subsequent attempt to unlock it can end
    up with memory corruption.
    Cc: stable@vger.kernel.org # 3.12+, counting backports
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    (cherry picked from commit 3b821409632ab778d46e807516b457dfa72736ed)
    Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
 fs/dcache.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

Patch hide | download patch | download mbox

diff --git a/fs/dcache.c b/fs/dcache.c
index 9053ee03397b..175ae8c7acb8 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -626,11 +626,16 @@  static inline struct dentry *lock_parent(struct dentry *dentry)
 		goto again;
-	rcu_read_unlock();
-	if (parent != dentry)
+	if (parent != dentry) {
 		spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
-	else
+		if (unlikely(dentry->d_lockref.count < 0)) {
+			spin_unlock(&parent->d_lock);
+			parent = NULL;
+		}
+	} else {
 		parent = NULL;
+	}
+	rcu_read_unlock();
 	return parent;