Commit f950fd05 authored by Jan Kara's avatar Jan Kara
Browse files

udf: Protect rename against modification of moved directory 



When we are renaming a directory to a different directory, we need to
update '..' entry in the moved directory. However nothing prevents moved
directory from being modified and even converted from the in-ICB format
to the normal format which results in a crash. Fix the problem by
locking the moved directory.

Reported-by: default avatar <syzbot+aebf90eea2671c43112a@syzkaller.appspotmail.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent 32f123a3

fs/udf/namei.c

+12 −2
Original line number Diff line number Diff line
@@ -786,6 +786,11 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir, 
			if (!empty_dir(new_inode))

				goto out_oiter;

		}

		/*

		 * We need to protect against old_inode getting converted from

		 * ICB to normal directory.

		 */

		inode_lock_nested(old_inode, I_MUTEX_NONDIR2);

		retval = udf_fiiter_find_entry(old_inode, &dotdot_name,

					       &diriter);

		if (retval == -ENOENT) {
@@ -794,8 +799,10 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir, 
				old_inode->i_ino);

			retval = -EFSCORRUPTED;

		}

		if (retval)

		if (retval) {

			inode_unlock(old_inode);

			goto out_oiter;

		}

		has_diriter = true;

		tloc = lelb_to_cpu(diriter.fi.icb.extLocation);

		if (udf_get_lb_pblock(old_inode->i_sb, &tloc, 0) !=
@@ -873,6 +880,7 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir, 
			       udf_dir_entry_len(&diriter.fi));

		udf_fiiter_write_fi(&diriter, NULL);

		udf_fiiter_release(&diriter);

		inode_unlock(old_inode);



		inode_dec_link_count(old_dir);

		if (new_inode)
@@ -884,8 +892,10 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir, 
	}

	return 0;

out_oiter:

	if (has_diriter)

	if (has_diriter) {

		udf_fiiter_release(&diriter);

		inode_unlock(old_inode);

	}

	udf_fiiter_release(&oiter);



	return retval;