summaryrefslogtreecommitdiff
path: root/fs/affs
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2018-05-06 12:15:20 -0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-05-30 07:50:16 +0200
commit5aba1dc0d56b399284845a33e59b2a8c4462e6ff (patch)
treea2351f651c18c962898777aff93a197fe8ddec58 /fs/affs
parent211922cfb229d820edcff93113ff64129c14192d (diff)
affs_lookup(): close a race with affs_remove_link()
commit 30da870ce4a4e007c901858a96e9e394a1daa74a upstream. we unlock the directory hash too early - if we are looking at secondary link and primary (in another directory) gets removed just as we unlock, we could have the old primary moved in place of the secondary, leaving us to look into freed entry (and leaving our dentry with ->d_fsdata pointing to a freed entry). Cc: stable@vger.kernel.org # 2.4.4+ Acked-by: David Sterba <dsterba@suse.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/affs')
-rw-r--r--fs/affs/namei.c10
1 files changed, 7 insertions, 3 deletions
diff --git a/fs/affs/namei.c b/fs/affs/namei.c
index 29186d29a3b6..2d4d4952e951 100644
--- a/fs/affs/namei.c
+++ b/fs/affs/namei.c
@@ -224,9 +224,10 @@ affs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags)
affs_lock_dir(dir);
bh = affs_find_entry(dir, dentry);
- affs_unlock_dir(dir);
- if (IS_ERR(bh))
+ if (IS_ERR(bh)) {
+ affs_unlock_dir(dir);
return ERR_CAST(bh);
+ }
if (bh) {
u32 ino = bh->b_blocknr;
@@ -240,10 +241,13 @@ affs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags)
}
affs_brelse(bh);
inode = affs_iget(sb, ino);
- if (IS_ERR(inode))
+ if (IS_ERR(inode)) {
+ affs_unlock_dir(dir);
return ERR_CAST(inode);
+ }
}
d_add(dentry, inode);
+ affs_unlock_dir(dir);
return NULL;
}