diff options
| author | Miklos Szeredi <mszeredi@redhat.com> | 2024-05-27 15:44:48 +0200 |
|---|---|---|
| committer | Miklos Szeredi <mszeredi@redhat.com> | 2024-05-28 10:06:55 +0200 |
| commit | db03d39053a97d2f2a6baec025ebdacbab5886d2 (patch) | |
| tree | 96a91584e0e0655c8e6adb46dfe1e251889833bd /fs | |
| parent | 1613e604df0cd359cf2a7fbd9be7a0bcfacfabd0 (diff) | |
ovl: fix copy-up in tmpfile
Move ovl_copy_up() call outside of ovl_want_write()/ovl_drop_write()
region, since copy up may also call ovl_want_write() resulting in recursive
locking on sb->s_writers.
Reported-and-tested-by: syzbot+85e58cdf5b3136471d4b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000f6865106191c3e58@google.com/
Fixes: 9a87907de359 ("ovl: implement tmpfile")
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/overlayfs/dir.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c index 116f542442dd..ab65e98a1def 100644 --- a/fs/overlayfs/dir.c +++ b/fs/overlayfs/dir.c @@ -1314,10 +1314,6 @@ static int ovl_create_tmpfile(struct file *file, struct dentry *dentry, int flags = file->f_flags | OVL_OPEN_FLAGS; int err; - err = ovl_copy_up(dentry->d_parent); - if (err) - return err; - old_cred = ovl_override_creds(dentry->d_sb); err = ovl_setup_cred_for_create(dentry, inode, mode, old_cred); if (err) @@ -1360,6 +1356,10 @@ static int ovl_tmpfile(struct mnt_idmap *idmap, struct inode *dir, if (!OVL_FS(dentry->d_sb)->tmpfile) return -EOPNOTSUPP; + err = ovl_copy_up(dentry->d_parent); + if (err) + return err; + err = ovl_want_write(dentry); if (err) return err; |