From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 24 Oct 2021 11:59:25 +0000 (+0200)
Subject: 4.4-stable patches
X-Git-Tag: v4.4.290~55
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a17ff48c5c9986be2ab0ab8b50b75597dc4d6198;p=thirdparty%2Fkernel%2Fstable-queue.git

4.4-stable patches

added patches:
	ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch
---

diff --git a/queue-4.4/ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch b/queue-4.4/ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch
new file mode 100644
index 00000000000..b6a6e6efbb7
--- /dev/null
+++ b/queue-4.4/ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch
@@ -0,0 +1,64 @@
+From a295aef603e109a47af355477326bd41151765b6 Mon Sep 17 00:00:00 2001
+From: Zheng Liang <zhengliang6@huawei.com>
+Date: Fri, 24 Sep 2021 09:16:27 +0800
+Subject: ovl: fix missing negative dentry check in ovl_rename()
+
+From: Zheng Liang <zhengliang6@huawei.com>
+
+commit a295aef603e109a47af355477326bd41151765b6 upstream.
+
+The following reproducer
+
+  mkdir lower upper work merge
+  touch lower/old
+  touch lower/new
+  mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge
+  rm merge/new
+  mv merge/old merge/new & unlink upper/new
+
+may result in this race:
+
+PROCESS A:
+  rename("merge/old", "merge/new");
+  overwrite=true,ovl_lower_positive(old)=true,
+  ovl_dentry_is_whiteout(new)=true -> flags |= RENAME_EXCHANGE
+
+PROCESS B:
+  unlink("upper/new");
+
+PROCESS A:
+  lookup newdentry in new_upperdir
+  call vfs_rename() with negative newdentry and RENAME_EXCHANGE
+
+Fix by adding the missing check for negative newdentry.
+
+Signed-off-by: Zheng Liang <zhengliang6@huawei.com>
+Fixes: e9be9d5e76e3 ("overlay filesystem")
+Cc: <stable@vger.kernel.org> # v3.18
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Masami Ichikawa(CIP) <masami.ichikawa@cybertrust.co.jp>
+
+---
+ fs/overlayfs/dir.c |   10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -824,9 +824,13 @@ static int ovl_rename2(struct inode *old
+ 		}
+ 	} else {
+ 		new_create = true;
+-		if (!d_is_negative(newdentry) &&
+-		    (!new_opaque || !ovl_is_whiteout(newdentry)))
+-			goto out_dput;
++		if (!d_is_negative(newdentry)) {
++			if (!new_opaque || !ovl_is_whiteout(newdentry))
++				goto out_dput;
++		} else {
++			if (flags & RENAME_EXCHANGE)
++				goto out_dput;
++		}
+ 	}
+ 
+ 	if (olddentry == trap)
diff --git a/queue-4.4/series b/queue-4.4/series
index c8e91a499bc..b006af416a1 100644
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -30,3 +30,4 @@ ocfs2-mount-fails-with-buffer-overflow-in-strlen.patch
 elfcore-correct-reference-to-config_uml.patch
 alsa-usb-audio-provide-quirk-for-sennheiser-gsp670-headset.patch
 asoc-dapm-fix-missing-kctl-change-notifications.patch
+ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch