android_kernel_oneplus_msm8998/fs/configfs
Al Viro 0120fc18b3 configfs: fix a deadlock in configfs_symlink()
commit 351e5d869e5ac10cb40c78b5f2d7dfc816ad4587 upstream.

Configfs abuses symlink(2).  Unlike the normal filesystems, it
wants the target resolved at symlink(2) time, like link(2) would've
done.  The problem is that ->symlink() is called with the parent
directory locked exclusive, so resolving the target inside the
->symlink() is easily deadlocked.

Short of really ugly games in sys_symlink() itself, all we can
do is to unlock the parent before resolving the target and
relock it after.  However, that invalidates the checks done
by the caller of ->symlink(), so we have to
	* check that dentry is still where it used to be
(it couldn't have been moved, but it could've been unhashed)
	* recheck that it's still negative (somebody else
might've successfully created a symlink with the same name
while we were looking the target up)
	* recheck the permissions on the parent directory.

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-12 19:13:24 +01:00
..
configfs_internal.h configfs_add_file: fold into its sole caller 2015-02-17 22:16:46 -05:00
dir.c configfs: Fix use-after-free when accessing sd->s_dentry 2019-06-22 08:18:26 +02:00
file.c configfs: remove old API 2015-10-13 22:17:57 -07:00
inode.c make simple_positive() public 2015-06-23 18:02:01 -04:00
item.c configfs: fix kernel infoleak through user-controlled format string 2015-07-17 16:39:53 -07:00
Kconfig
Makefile
mount.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 2015-07-03 15:20:57 -07:00
symlink.c configfs: fix a deadlock in configfs_symlink() 2019-11-12 19:13:24 +01:00