Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1949275AbdDYPN0 (ORCPT ); Tue, 25 Apr 2017 11:13:26 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:55032 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1949065AbdDYPMJ (ORCPT ); Tue, 25 Apr 2017 11:12:09 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ralph Sennhauser , Amir Goldstein , Richard Weinberger Subject: [PATCH 4.10 17/24] ubifs: Fix O_TMPFILE corner case in ubifs_link() Date: Tue, 25 Apr 2017 16:09:26 +0100 Message-Id: <20170425150834.988367384@linuxfoundation.org> X-Mailer: git-send-email 2.12.2 In-Reply-To: <20170425150834.258486705@linuxfoundation.org> References: <20170425150834.258486705@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1630 Lines: 53 4.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Richard Weinberger commit 32fe905c17f001c0eee13c59afddd0bf2eed509c upstream. It is perfectly fine to link a tmpfile back using linkat(). Since tmpfiles are created with a link count of 0 they appear on the orphan list, upon re-linking the inode has to be removed from the orphan list again. Ralph faced a filesystem corruption in combination with overlayfs due to this bug. Cc: Ralph Sennhauser Cc: Amir Goldstein Reported-by: Ralph Sennhauser Tested-by: Ralph Sennhauser Reported-by: Amir Goldstein Fixes: 474b93704f321 ("ubifs: Implement O_TMPFILE") Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman --- fs/ubifs/dir.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -748,6 +748,11 @@ static int ubifs_link(struct dentry *old goto out_fname; lock_2_inodes(dir, inode); + + /* Handle O_TMPFILE corner case, it is allowed to link a O_TMPFILE. */ + if (inode->i_nlink == 0) + ubifs_delete_orphan(c, inode->i_ino); + inc_nlink(inode); ihold(inode); inode->i_ctime = ubifs_current_time(inode); @@ -768,6 +773,8 @@ out_cancel: dir->i_size -= sz_change; dir_ui->ui_size = dir->i_size; drop_nlink(inode); + if (inode->i_nlink == 0) + ubifs_add_orphan(c, inode->i_ino); unlock_2_inodes(dir, inode); ubifs_release_budget(c, &req); iput(inode);