From: Eric Biggers <ebiggers@kernel.org>
To: Al Viro <viro@zeniv.linux.org.uk>
Cc: linux-fscrypt@vger.kernel.org, linux-fsdevel@vger.kernel.org,
linux-ext4@vger.kernel.org,
linux-f2fs-devel@lists.sourceforge.net,
linux-mtd@lists.infradead.org, linux-unionfs@vger.kernel.org,
Sarthak Kukreti <sarthakkukreti@chromium.org>,
Gao Xiang <gaoxiang25@huawei.com>
Subject: Re: [PATCH 1/5] fscrypt: clean up and improve dentry revalidation
Date: Mon, 18 Mar 2019 13:29:49 -0700 [thread overview]
Message-ID: <20190318202948.GD194307@gmail.com> (raw)
In-Reply-To: <20190317203822.GH2217@ZenIV.linux.org.uk>
On Sun, Mar 17, 2019 at 08:38:22PM +0000, Al Viro wrote:
> On Sun, Mar 17, 2019 at 01:04:40PM -0700, Eric Biggers wrote:
> > + /*
> > + * Ciphertext name; valid if the directory's key is still unavailable.
> > + *
> > + * Note: since fscrypt forbids rename() on ciphertext names, it should
> > + * be safe to access ->d_parent directly here.
>
> No, it is not. Again, d_splice_alias() on buggered fs image picking a reference
> to your subdirectory when doing a lookup elsewhere. It can relocate the
> damn thing, without rename() being allowed for _anything_.
You're talking about directory hard links, right? E.g. if there's a directory
with two links a/dir and b/dir, and fscrypt_d_revalidate() is running on 'dir'
via a lookup in a/, it could be the case that b/dir is being concurrently looked
up. Then the concurrent d_splice_alias() will move the whole dentry tree rooted
at 'dir' from a/ to b/ in the dcache. Okay, it looks like you're right; I'll
update my comment to clarify that dget_parent() is still needed...
- Eric
next prev parent reply other threads:[~2019-03-18 20:29 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-17 20:04 [PATCH 0/5] fscrypt: d_revalidate fixes and cleanups Eric Biggers
2019-03-17 20:04 ` [PATCH 1/5] fscrypt: clean up and improve dentry revalidation Eric Biggers
2019-03-17 20:38 ` Al Viro
2019-03-18 20:29 ` Eric Biggers [this message]
2019-03-18 21:25 ` Al Viro
2019-03-17 20:04 ` [PATCH 2/5] fscrypt: fix race allowing rename() and link() of ciphertext dentries Eric Biggers
2019-03-17 20:04 ` [PATCH 3/5] fs, fscrypt: clear DCACHE_ENCRYPTED_NAME when unaliasing directory Eric Biggers
2019-03-17 20:04 ` [PATCH 4/5] fscrypt: only set dentry_operations on ciphertext dentries Eric Biggers
2019-03-17 20:04 ` [PATCH 5/5] fscrypt: fix race where ->lookup() marks plaintext dentry as ciphertext Eric Biggers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190318202948.GD194307@gmail.com \
--to=ebiggers@kernel.org \
--cc=gaoxiang25@huawei.com \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-fscrypt@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-mtd@lists.infradead.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=sarthakkukreti@chromium.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).