Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753590AbdGPOQy (ORCPT ); Sun, 16 Jul 2017 10:16:54 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:44324 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752855AbdGPOQv (ORCPT ); Sun, 16 Jul 2017 10:16:51 -0400 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Luis Henriques" , "Yan, Zheng" , "Jerry Lee" , "Ilya Dryomov" , "Jeff Layton" Date: Sun, 16 Jul 2017 14:56:46 +0100 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 171/178] ceph: fix recursion between ceph_set_acl() and __ceph_setattr() In-Reply-To: X-SA-Exim-Connect-IP: 2a02:8011:400e:2:6f00:88c8:c921:d332 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1988 Lines: 63 3.16.46-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: "Yan, Zheng" commit 8179a101eb5f4ef0ac9a915fcea9a9d3109efa90 upstream. ceph_set_acl() calls __ceph_setattr() if the setacl operation needs to modify inode's i_mode. __ceph_setattr() updates inode's i_mode, then calls posix_acl_chmod(). The problem is that __ceph_setattr() calls posix_acl_chmod() before sending the setattr request. The get_acl() call in posix_acl_chmod() can trigger a getxattr request. The reply of the getxattr request can restore inode's i_mode to its old value. The set_acl() call in posix_acl_chmod() sees old value of inode's i_mode, so it calls __ceph_setattr() again. Link: http://tracker.ceph.com/issues/19688 Reported-by: Jerry Lee Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Tested-by: Luis Henriques Signed-off-by: Ilya Dryomov [bwh: Backported to 3.16: All the changes are made in ceph_setattr() as there is no __ceph_setattr() function.] Signed-off-by: Ben Hutchings --- --- a/fs/ceph/inode.c +++ b/fs/ceph/inode.c @@ -1875,12 +1875,6 @@ int ceph_setattr(struct dentry *dentry, if (inode_dirty_flags) __mark_inode_dirty(inode, inode_dirty_flags); - if (ia_valid & ATTR_MODE) { - err = posix_acl_chmod(inode, attr->ia_mode); - if (err) - goto out_put; - } - if (mask) { req->r_inode = inode; ihold(inode); @@ -1893,12 +1887,16 @@ int ceph_setattr(struct dentry *dentry, ceph_cap_string(dirtied), mask); ceph_mdsc_put_request(req); - if (mask & CEPH_SETATTR_SIZE) + + if (err >= 0 && (mask & CEPH_SETATTR_SIZE)) __ceph_do_pending_vmtruncate(inode); + + if (err >= 0 && (attr->ia_valid & ATTR_MODE)) + err = posix_acl_chmod(inode, attr->ia_mode); + return err; out: spin_unlock(&ci->i_ceph_lock); -out_put: ceph_mdsc_put_request(req); return err; }