4.4-stable patches

added patches:
	ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch

diff --git a/queue-4.4/ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch b/queue-4.4/ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch
new file mode 100644 (file)
index 0000000..b6a6e6e
--- /dev/null
+++ b/queue-4.4/ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch
@@ -0,0 +1,64 @@
+From a295aef603e109a47af355477326bd41151765b6 Mon Sep 17 00:00:00 2001
+From: Zheng Liang <zhengliang6@huawei.com>
+Date: Fri, 24 Sep 2021 09:16:27 +0800
+Subject: ovl: fix missing negative dentry check in ovl_rename()
+
+From: Zheng Liang <zhengliang6@huawei.com>
+
+commit a295aef603e109a47af355477326bd41151765b6 upstream.
+
+The following reproducer
+
+  mkdir lower upper work merge
+  touch lower/old
+  touch lower/new
+  mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge
+  rm merge/new
+  mv merge/old merge/new & unlink upper/new
+
+may result in this race:
+
+PROCESS A:
+  rename("merge/old", "merge/new");
+  overwrite=true,ovl_lower_positive(old)=true,
+  ovl_dentry_is_whiteout(new)=true -> flags |= RENAME_EXCHANGE
+
+PROCESS B:
+  unlink("upper/new");
+
+PROCESS A:
+  lookup newdentry in new_upperdir
+  call vfs_rename() with negative newdentry and RENAME_EXCHANGE
+
+Fix by adding the missing check for negative newdentry.
+
+Signed-off-by: Zheng Liang <zhengliang6@huawei.com>
+Fixes: e9be9d5e76e3 ("overlay filesystem")
+Cc: <stable@vger.kernel.org> # v3.18
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Masami Ichikawa(CIP) <masami.ichikawa@cybertrust.co.jp>
+
+---
+ fs/overlayfs/dir.c |   10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -824,9 +824,13 @@ static int ovl_rename2(struct inode *old
+               }
+       } else {
+               new_create = true;
+-              if (!d_is_negative(newdentry) &&
+-                  (!new_opaque || !ovl_is_whiteout(newdentry)))
+-                      goto out_dput;
++              if (!d_is_negative(newdentry)) {
++                      if (!new_opaque || !ovl_is_whiteout(newdentry))
++                              goto out_dput;
++              } else {
++                      if (flags & RENAME_EXCHANGE)
++                              goto out_dput;
++              }
+       }
+ 
+       if (olddentry == trap)

diff --git a/queue-4.4/series b/queue-4.4/series
index c8e91a499bc7602957e764e64d3bbcac5c1f5377..b006af416a160615d6598d644bb54519204921b6 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -30,3 +30,4 @@ ocfs2-mount-fails-with-buffer-overflow-in-strlen.patch
 elfcore-correct-reference-to-config_uml.patch
 alsa-usb-audio-provide-quirk-for-sennheiser-gsp670-headset.patch
 asoc-dapm-fix-missing-kctl-change-notifications.patch
+ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch