[5.10,054/120] ovl: fix dentry leak in ovl_get_redirect

From: Liangyan <liangyan.peng@linux.alibaba.com>

From: Liangyan <liangyan.peng@linux.alibaba.com>

commit e04527fefba6e4e66492f122cf8cc6314f3cf3bf upstream.

We need to lock d_parent->d_lock before dget_dlock, or this may
have d_lockref updated parallelly like calltrace below which will
cause dentry->d_lockref leak and risk a crash.

     CPU 0                                CPU 1
ovl_set_redirect                       lookup_fast
  ovl_get_redirect                       __d_lookup
    dget_dlock
      //no lock protection here            spin_lock(&dentry->d_lock)
      dentry->d_lockref.count++            dentry->d_lockref.count++

[   49.799059] PGD 800000061fed7067 P4D 800000061fed7067 PUD 61fec5067 PMD 0
[   49.799689] Oops: 0002 [#1] SMP PTI
[   49.800019] CPU: 2 PID: 2332 Comm: node Not tainted 4.19.24-7.20.al7.x86_64 #1
[   49.800678] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8a46cfe 04/01/2014
[   49.801380] RIP: 0010:_raw_spin_lock+0xc/0x20
[   49.803470] RSP: 0018:ffffac6fc5417e98 EFLAGS: 00010246
[   49.803949] RAX: 0000000000000000 RBX: ffff93b8da3446c0 RCX: 0000000a00000000
[   49.804600] RDX: 0000000000000001 RSI: 000000000000000a RDI: 0000000000000088
[   49.805252] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff993cf040
[   49.805898] R10: ffff93b92292e580 R11: ffffd27f188a4b80 R12: 0000000000000000
[   49.806548] R13: 00000000ffffff9c R14: 00000000fffffffe R15: ffff93b8da3446c0
[   49.807200] FS:  00007ffbedffb700(0000) GS:ffff93b927880000(0000) knlGS:0000000000000000
[   49.807935] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   49.808461] CR2: 0000000000000088 CR3: 00000005e3f74006 CR4: 00000000003606a0
[   49.809113] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   49.809758] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   49.810410] Call Trace:
[   49.810653]  d_delete+0x2c/0xb0
[   49.810951]  vfs_rmdir+0xfd/0x120
[   49.811264]  do_rmdir+0x14f/0x1a0
[   49.811573]  do_syscall_64+0x5b/0x190
[   49.811917]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   49.812385] RIP: 0033:0x7ffbf505ffd7
[   49.814404] RSP: 002b:00007ffbedffada8 EFLAGS: 00000297 ORIG_RAX: 0000000000000054
[   49.815098] RAX: ffffffffffffffda RBX: 00007ffbedffb640 RCX: 00007ffbf505ffd7
[   49.815744] RDX: 0000000004449700 RSI: 0000000000000000 RDI: 0000000006c8cd50
[   49.816394] RBP: 00007ffbedffaea0 R08: 0000000000000000 R09: 0000000000017d0b
[   49.817038] R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000012
[   49.817687] R13: 00000000072823d8 R14: 00007ffbedffb700 R15: 00000000072823d8
[   49.818338] Modules linked in: pvpanic cirrusfb button qemu_fw_cfg atkbd libps2 i8042
[   49.819052] CR2: 0000000000000088
[   49.819368] ---[ end trace 4e652b8aa299aa2d ]---
[   49.819796] RIP: 0010:_raw_spin_lock+0xc/0x20
[   49.821880] RSP: 0018:ffffac6fc5417e98 EFLAGS: 00010246
[   49.822363] RAX: 0000000000000000 RBX: ffff93b8da3446c0 RCX: 0000000a00000000
[   49.823008] RDX: 0000000000000001 RSI: 000000000000000a RDI: 0000000000000088
[   49.823658] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff993cf040
[   49.825404] R10: ffff93b92292e580 R11: ffffd27f188a4b80 R12: 0000000000000000
[   49.827147] R13: 00000000ffffff9c R14: 00000000fffffffe R15: ffff93b8da3446c0
[   49.828890] FS:  00007ffbedffb700(0000) GS:ffff93b927880000(0000) knlGS:0000000000000000
[   49.830725] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   49.832359] CR2: 0000000000000088 CR3: 00000005e3f74006 CR4: 00000000003606a0
[   49.834085] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   49.835792] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Cc: <stable@vger.kernel.org>
Fixes: a6c606551141 ("ovl: redirect on rename-dir")
Signed-off-by: Liangyan <liangyan.peng@linux.alibaba.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/dir.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Message ID	20210208145820.577049939@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Liangyan <liangyan.peng@linux.alibaba.com>, Joseph Qi <joseph.qi@linux.alibaba.com>, Al Viro <viro@zeniv.linux.org.uk>, Miklos Szeredi <mszeredi@redhat.com> Subject: [PATCH 5.10 054/120] ovl: fix dentry leak in ovl_get_redirect Date: Mon, 8 Feb 2021 16:00:41 +0100 Message-Id: <20210208145820.577049939@linuxfoundation.org> In-Reply-To: <20210208145818.395353822@linuxfoundation.org> References: <20210208145818.395353822@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,003/120] USB: serial: option: Adding support for Cinterion MV31 [5.10,005/120] USB: gadget: legacy: fix an error code in eth_bind() [5.10,007/120] USB: usblp: dont call usb_set_interface if theres a single alt [5.10,009/120] usb: dwc2: Fix endpoint direction check in ep_from_windex [5.10,010/120] usb: dwc3: fix clock issue during resume in OTG mode [5.10,012/120] usb: xhci-mtk: skip dropping bandwidth of unchecked endpoints [5.10,014/120] ARM: OMAP1: OSK: fix ohci-omap breakage [5.10,015/120] arm64: dts: qcom: c630: keep both touchpad devices enabled [5.10,016/120] Input: i8042 - unbreak Pegatron C15B [5.10,017/120] arm64: dts: amlogic: meson-g12: Set FL-adj property value [5.10,018/120] arm64: dts: rockchip: fix vopl iommu irq on px30 [5.10,019/120] arm64: dts: rockchip: Use only supported PCIe link speed on Pinebook Pro [5.10,022/120] ARM: dts: stm32: Disable WP on DHCOM uSD slot [5.10,025/120] vdpa/mlx5: Fix memory key MTT population [5.10,026/120] bpf, cgroup: Fix optlen WARN_ON_ONCE toctou [5.10,029/120] um: virtio: free vu_dev only with the contained struct device [5.10,030/120] bpf, preload: Fix build when $(O) points to a relative path [5.10,031/120] arm64: dts: meson: switch TFLASH_VDD_EN pin to open drain on Odroid-C4 [5.10,032/120] r8169: work around RTL8125 UDP hw bug [5.10,034/120] arm64: dts: ls1046a: fix dcfg address range [5.10,036/120] igc: set the default return value to -IGC_ERR_NVM in igc_write_nvm_srwr [5.10,039/120] ibmvnic: device remove has higher precedence over reset [5.10,040/120] net/mlx5: Fix function calculation for page trees [5.10,041/120] net/mlx5: Fix leak upon failure of rule creation [5.10,042/120] net/mlx5e: Update max_opened_tc also when channels are closed [5.10,046/120] r8169: fix WoL on shutdown if CONFIG_DEBUG_SHIRQ is set [5.10,048/120] ARM: dts: sun7i: a20: bananapro: Fix ethernet phy-mode [5.10,050/120] vdpa/mlx5: Restore the hardware used index after change map [5.10,051/120] memblock: do not start bottom-up allocations with kernel_end [5.10,053/120] thunderbolt: Fix possible NULL pointer dereference in tb_acpi_add_link() [5.10,054/120] ovl: fix dentry leak in ovl_get_redirect [5.10,057/120] mac80211: fix station rate table updates on assoc [5.10,062/120] tracing: Use pause-on-trace with the latency tracers [5.10,063/120] tracepoint: Fix race between tracing and removing tracepoint [5.10,064/120] libnvdimm/namespace: Fix visibility of namespace resource attribute [5.10,065/120] libnvdimm/dimm: Avoid race between probe and available_slots_show() [5.10,067/120] genirq/msi: Activate Multi-MSI early when MSI_FLAG_ACTIVATE_EARLY is set [5.10,070/120] RISC-V: Define MAXPHYSMEM_1GB only for RV32 [5.10,073/120] smb3: Fix out-of-bounds bug in SMB2_negotiate() [5.10,075/120] mmc: sdhci-pltfm: Fix linking err for sdhci-brcmstb [5.10,077/120] Fix unsynchronized access to sev members through svm_register_enc_region [5.10,078/120] drm/dp/mst: Export drm_dp_get_vc_payload_bw() [5.10,079/120] drm/i915: Fix the MST PBN divider calculation [5.10,081/120] drm/i915/gt: Close race between enable_breadcrumbs and cancel_breadcrumbs [5.10,083/120] drm/i915: Extract intel_ddi_power_up_lanes() [5.10,084/120] drm/i915: Power up combo PHY lanes for for HDMI as well [5.10,089/120] KVM: x86/mmu: Fix TDP MMU zap collapsible SPTEs [5.10,090/120] KVM: x86: Allow guests to see MSR_IA32_TSX_CTRL even if tsx=off [5.10,093/120] KVM: x86: Set so called reserved CR3 bits in LM mask at vCPU reset [5.10,096/120] ARM: footbridge: fix dc21285 PCI configuration accessors [5.10,097/120] ARM: 9043/1: tegra: Fix misplaced tegra_uart_config in decompressor [5.10,098/120] mm: hugetlbfs: fix cannot migrate the fallocated HugeTLB page [5.10,099/120] mm: hugetlb: fix a race between freeing and dissolving the page [5.10,100/120] mm: hugetlb: fix a race between isolating and freeing page [5.10,102/120] mm, compaction: move high_pfn to the for loop scope [5.10,103/120] mm/vmalloc: separate put pages and flush VM flags [5.10,108/120] x86/debug: Prevent data breakpoints on __per_cpu_offset [5.10,109/120] x86/debug: Prevent data breakpoints on cpu_dr7 [5.10,110/120] x86/apic: Add extra serialization for non-serializing MSRs [5.10,111/120] Input: goodix - add support for Goodix GT9286 chip [5.10,113/120] Input: ili210x - implement pressure reporting for ILI251x [5.10,114/120] md: Set prev_flush_start and flush_bio in an atomic way [5.10,120/120] net: sched: replaced invalid qdisc tree flush helper in qdisc_replace

[5.10,054/120] ovl: fix dentry leak in ovl_get_redirect

Commit Message

Patch