public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

bch2_ioctl_subvolume_destroy(): fix locking

Browse source 
make it use user_path_locked_at() to get the normal directory protection
for modifications, as well as stable ->d_parent and ->d_name in victim

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Al Viro 2023-11-14 18:52:42 -05:00
parent 74d016ecc1
commit bbe6a7c899
1 changed files with 17 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
fs/bcachefs/fs-ioctl.c
View file

@ -453,33 +453,36 @@ static long bch2_ioctl_subvolume_create(struct bch_fs *c, struct file *filp,
static long bch2_ioctl_subvolume_destroy(struct bch_fs *c, struct file *filp, static long bch2_ioctl_subvolume_destroy(struct bch_fs *c, struct file *filp,
struct bch_ioctl_subvolume arg) struct bch_ioctl_subvolume arg)
{ {
const char __user *name = (void __user *)(unsigned long)arg.dst_ptr;
struct path path; struct path path;
struct inode *dir; struct inode *dir;
struct dentry *victim;
int ret = 0; int ret = 0;
if (arg.flags) if (arg.flags)
return -EINVAL; return -EINVAL;
ret = user_path_at(arg.dirfd, victim = user_path_locked_at(arg.dirfd, name, &path);
(const char __user *)(unsigned long)arg.dst_ptr, if (IS_ERR(victim))
LOOKUP_FOLLOW, &path); return PTR_ERR(victim);
if (ret)
return ret;
if (path.dentry->d_sb->s_fs_info != c) { if (victim->d_sb->s_fs_info != c) {
ret = -EXDEV; ret = -EXDEV;
goto err; goto err;
} }
if (!d_is_positive(victim)) {
dir = path.dentry->d_parent->d_inode; ret = -ENOENT;
ret = __bch2_unlink(dir, path.dentry, true);
if (ret)
goto err; goto err;
}
fsnotify_rmdir(dir, path.dentry); dir = d_inode(path.dentry);
d_delete(path.dentry); ret = __bch2_unlink(dir, victim, true);
if (!ret) {
fsnotify_rmdir(dir, victim);
d_delete(victim);
}
inode_unlock(dir);
err: err:
dput(victim);
path_put(&path); path_put(&path);
return ret; return ret;
} }