diff options
| author | Jan Kara <jack@suse.cz> | 2023-01-18 19:42:35 +0100 |
|---|---|---|
| committer | Jan Kara <jack@suse.cz> | 2023-01-26 16:46:34 +0100 |
| commit | f950fd0529130a617b3da526da9fb6a896ce87c2 (patch) | |
| tree | a89823d9ba8c1ef7ff5719cd1c2c05e2a4ee3902 /fs/udf | |
| parent | 32f123a3f34283f9c6446de87861696f0502b02e (diff) | |
| download | linux-f950fd0529130a617b3da526da9fb6a896ce87c2.tar.gz | |
udf: Protect rename against modification of moved directory
When we are renaming a directory to a different directory, we need to
update '..' entry in the moved directory. However nothing prevents moved
directory from being modified and even converted from the in-ICB format
to the normal format which results in a crash. Fix the problem by
locking the moved directory.
Reported-by: syzbot+aebf90eea2671c43112a@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'fs/udf')
| -rw-r--r-- | fs/udf/namei.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/fs/udf/namei.c b/fs/udf/namei.c index 87257f49b5da1..663b66014c98e 100644 --- a/fs/udf/namei.c +++ b/fs/udf/namei.c @@ -786,6 +786,11 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir, if (!empty_dir(new_inode)) goto out_oiter; } + /* + * We need to protect against old_inode getting converted from + * ICB to normal directory. + */ + inode_lock_nested(old_inode, I_MUTEX_NONDIR2); retval = udf_fiiter_find_entry(old_inode, &dotdot_name, &diriter); if (retval == -ENOENT) { @@ -794,8 +799,10 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir, old_inode->i_ino); retval = -EFSCORRUPTED; } - if (retval) + if (retval) { + inode_unlock(old_inode); goto out_oiter; + } has_diriter = true; tloc = lelb_to_cpu(diriter.fi.icb.extLocation); if (udf_get_lb_pblock(old_inode->i_sb, &tloc, 0) != @@ -873,6 +880,7 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir, udf_dir_entry_len(&diriter.fi)); udf_fiiter_write_fi(&diriter, NULL); udf_fiiter_release(&diriter); + inode_unlock(old_inode); inode_dec_link_count(old_dir); if (new_inode) @@ -884,8 +892,10 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir, } return 0; out_oiter: - if (has_diriter) + if (has_diriter) { udf_fiiter_release(&diriter); + inode_unlock(old_inode); + } udf_fiiter_release(&oiter); return retval; |