ovl: fix copy-up in tmpfile

Move ovl_copy_up() call outside of ovl_want_write()/ovl_drop_write()
region, since copy up may also call ovl_want_write() resulting in recursive
locking on sb->s_writers.

Reported-and-tested-by: syzbot+85e58cdf5b3136471d4b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000f6865106191c3e58@google.com/
Fixes: 9a87907de359 ("ovl: implement tmpfile")
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 116f542442ddd670c3a62861ef83c44d76f0a7f9..ab65e98a1defdd0981300b27cdd71d5c7ed0eab4 100644 (file)
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -1314,10 +1314,6 @@ static int ovl_create_tmpfile(struct file *file, struct dentry *dentry,
        int flags = file->f_flags | OVL_OPEN_FLAGS;
        int err;
 
-       err = ovl_copy_up(dentry->d_parent);
-       if (err)
-               return err;
-
        old_cred = ovl_override_creds(dentry->d_sb);
        err = ovl_setup_cred_for_create(dentry, inode, mode, old_cred);
        if (err)
@@ -1360,6 +1356,10 @@ static int ovl_tmpfile(struct mnt_idmap *idmap, struct inode *dir,
        if (!OVL_FS(dentry->d_sb)->tmpfile)
                return -EOPNOTSUPP;
 
+       err = ovl_copy_up(dentry->d_parent);
+       if (err)
+               return err;
+
        err = ovl_want_write(dentry);
        if (err)
                return err;