Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753907AbcDRDSo (ORCPT ); Sun, 17 Apr 2016 23:18:44 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:36245 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752575AbcDRCeU (ORCPT ); Sun, 17 Apr 2016 22:34:20 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miklos Szeredi , Theodore Tso Subject: [PATCH 4.5 107/124] ext4: use dget_parent() in ext4_file_open() Date: Mon, 18 Apr 2016 11:29:39 +0900 Message-Id: <20160418022621.214066370@linuxfoundation.org> X-Mailer: git-send-email 2.8.0 In-Reply-To: <20160418022615.726954227@linuxfoundation.org> References: <20160418022615.726954227@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1923 Lines: 57 4.5-stable review patch. If anyone has any objections, please let me know. ------------------ From: Miklos Szeredi commit 9dd78d8c9a7bd4bc341f5864db32d4331b8eae4c upstream. In f_op->open() lock on parent is not held, so there's no guarantee that parent dentry won't go away at any time. Even after this patch there's no guarantee that 'dir' will stay the parent of 'inode', but at least it won't be freed while being used. Fixes: ff978b09f973 ("ext4 crypto: move context consistency check to ext4_file_open()") Signed-off-by: Miklos Szeredi Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman --- fs/ext4/file.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) --- a/fs/ext4/file.c +++ b/fs/ext4/file.c @@ -335,7 +335,7 @@ static int ext4_file_open(struct inode * struct super_block *sb = inode->i_sb; struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); struct vfsmount *mnt = filp->f_path.mnt; - struct inode *dir = filp->f_path.dentry->d_parent->d_inode; + struct dentry *dir; struct path path; char buf[64], *cp; int ret; @@ -379,14 +379,18 @@ static int ext4_file_open(struct inode * if (ext4_encryption_info(inode) == NULL) return -ENOKEY; } - if (ext4_encrypted_inode(dir) && - !ext4_is_child_context_consistent_with_parent(dir, inode)) { + + dir = dget_parent(filp->f_path.dentry); + if (ext4_encrypted_inode(d_inode(dir)) && + !ext4_is_child_context_consistent_with_parent(d_inode(dir), inode)) { ext4_warning(inode->i_sb, "Inconsistent encryption contexts: %lu/%lu\n", - (unsigned long) dir->i_ino, + (unsigned long) d_inode(dir)->i_ino, (unsigned long) inode->i_ino); + dput(dir); return -EPERM; } + dput(dir); /* * Set up the jbd2_inode if we are opening the inode for * writing and the journal is present