• Al Viro's avatar
    lock_parent() needs to recheck if dentry got __dentry_kill'ed under it · b071bce3
    Al Viro authored
    commit 3b821409 upstream.
    
    In case when dentry passed to lock_parent() is protected from freeing only
    by the fact that it's on a shrink list and trylock of parent fails, we
    could get hit by __dentry_kill() (and subsequent dentry_kill(parent))
    between unlocking dentry and locking presumed parent.  We need to recheck
    that dentry is alive once we lock both it and parent *and* postpone
    rcu_read_unlock() until after that point.  Otherwise we could return
    a pointer to struct dentry that already is rcu-scheduled for freeing, with
    ->d_lock held on it; caller's subsequent attempt to unlock it can end
    up with memory corruption.
    
    Cc: stable@vger.kernel.org # 3.12+, counting backports
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    b071bce3
dcache.c 94.6 KB