A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 03:27:44 -04:00
Code Issues Projects Releases Packages Wiki Activity

ubifs: Fix O_TMPFILE corner case in ubifs_link()

Browse source 
It is perfectly fine to link a tmpfile back using linkat().
Since tmpfiles are created with a link count of 0 they appear
on the orphan list, upon re-linking the inode has to be removed
from the orphan list again.

Ralph faced a filesystem corruption in combination with overlayfs
due to this bug.

Cc: <[email protected]>
Cc: Ralph Sennhauser <[email protected]>
Cc: Amir Goldstein <[email protected]>
Reported-by: Ralph Sennhauser <[email protected]>
Tested-by: Ralph Sennhauser <[email protected]>
Reported-by: Amir Goldstein <[email protected]>
Fixes: 474b93704f ("ubifs: Implement O_TMPFILE")
Signed-off-by: Richard Weinberger <[email protected]>
This commit is contained in:
Richard Weinberger 2017-03-30 10:50:49 +02:00
commit 32fe905c17
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
fs/ubifs/dir.c
View file

@ -748,6 +748,11 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir,
goto out_fname;
lock_2_inodes(dir, inode);
/* Handle O_TMPFILE corner case, it is allowed to link a O_TMPFILE. */
if (inode->i_nlink == 0)
ubifs_delete_orphan(c, inode->i_ino);
inc_nlink(inode);
ihold(inode);
inode->i_ctime = ubifs_current_time(inode);
@ -768,6 +773,8 @@ out_cancel:
dir->i_size -= sz_change;
dir_ui->ui_size = dir->i_size;
drop_nlink(inode);
if (inode->i_nlink == 0)
ubifs_add_orphan(c, inode->i_ino);
unlock_2_inodes(dir, inode);
ubifs_release_budget(c, &req);
iput(inode);