linux-mm.kvack.org archive mirror
 help / color / mirror / Atom feed
From: cel@kernel.org
To: Hugh Dickins <hughd@google.com>,
	Andrew Morten <akpm@linux-foundation.org>,
	Christian Brauner <brauner@kernel.org>,
	Al Viro <viro@zeniv.linux.org.uk>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Sasha Levin <sashal@kernel.org>
Cc: <linux-fsdevel@vger.kernel.org>, <stable@vger.kernel.org>,
	<linux-mm@kvack.org>,
	yukuai3@huawei.com, yangerkun@huawei.com,
	Chuck Lever <chuck.lever@oracle.com>
Subject: [RFC PATCH v6.6 04/10] libfs: Fix simple_offset_rename_exchange()
Date: Fri, 24 Jan 2025 14:19:39 -0500	[thread overview]
Message-ID: <20250124191946.22308-5-cel@kernel.org> (raw)
In-Reply-To: <20250124191946.22308-1-cel@kernel.org>

From: Chuck Lever <chuck.lever@oracle.com>

[ Upstream commit 23cdd0eed3f1fff3af323092b0b88945a7950d8e ]

User space expects the replacement (old) directory entry to have
the same directory offset after the rename.

Suggested-by: Christian Brauner <brauner@kernel.org>
Fixes: a2e459555c5f ("shmem: stable directory offsets")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Link: https://lore.kernel.org/r/20240415152057.4605-2-cel@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
[ cel: adjusted to apply to origin/linux-6.6.y ]
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
 fs/libfs.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/fs/libfs.c b/fs/libfs.c
index d7b901cb9af4..2029cb6a0e15 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -294,6 +294,18 @@ int simple_offset_add(struct offset_ctx *octx, struct dentry *dentry)
 	return 0;
 }
 
+static int simple_offset_replace(struct offset_ctx *octx, struct dentry *dentry,
+				 long offset)
+{
+	void *ret;
+
+	ret = xa_store(&octx->xa, offset, dentry, GFP_KERNEL);
+	if (xa_is_err(ret))
+		return xa_err(ret);
+	offset_set(dentry, offset);
+	return 0;
+}
+
 /**
  * simple_offset_remove - Remove an entry to a directory's offset map
  * @octx: directory offset ctx to be updated
@@ -351,6 +363,9 @@ int simple_offset_empty(struct dentry *dentry)
  * @new_dir: destination parent
  * @new_dentry: destination dentry
  *
+ * This API preserves the directory offset values. Caller provides
+ * appropriate serialization.
+ *
  * Returns zero on success. Otherwise a negative errno is returned and the
  * rename is rolled back.
  */
@@ -368,11 +383,11 @@ int simple_offset_rename_exchange(struct inode *old_dir,
 	simple_offset_remove(old_ctx, old_dentry);
 	simple_offset_remove(new_ctx, new_dentry);
 
-	ret = simple_offset_add(new_ctx, old_dentry);
+	ret = simple_offset_replace(new_ctx, old_dentry, new_index);
 	if (ret)
 		goto out_restore;
 
-	ret = simple_offset_add(old_ctx, new_dentry);
+	ret = simple_offset_replace(old_ctx, new_dentry, old_index);
 	if (ret) {
 		simple_offset_remove(new_ctx, old_dentry);
 		goto out_restore;
@@ -387,10 +402,8 @@ int simple_offset_rename_exchange(struct inode *old_dir,
 	return 0;
 
 out_restore:
-	offset_set(old_dentry, old_index);
-	xa_store(&old_ctx->xa, old_index, old_dentry, GFP_KERNEL);
-	offset_set(new_dentry, new_index);
-	xa_store(&new_ctx->xa, new_index, new_dentry, GFP_KERNEL);
+	(void)simple_offset_replace(old_ctx, old_dentry, old_index);
+	(void)simple_offset_replace(new_ctx, new_dentry, new_index);
 	return ret;
 }
 
-- 
2.47.0



  parent reply	other threads:[~2025-01-24 19:20 UTC|newest]

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-01-24 19:19 [RFC PATCH v6.6 00/10] Address CVE-2024-46701 cel
2025-01-24 19:19 ` [RFC PATCH v6.6 01/10] libfs: Re-arrange locking in offset_iterate_dir() cel
2025-01-24 19:19 ` [RFC PATCH v6.6 02/10] libfs: Define a minimum directory offset cel
2025-01-30  8:59   ` Patch "libfs: Define a minimum directory offset" has been added to the 6.6-stable tree gregkh
2025-01-24 19:19 ` [RFC PATCH v6.6 03/10] libfs: Add simple_offset_empty() cel
2025-01-30  8:59   ` Patch "libfs: Add simple_offset_empty()" has been added to the 6.6-stable tree gregkh
2025-01-24 19:19 ` cel [this message]
2025-01-30  8:59   ` Patch "libfs: Fix simple_offset_rename_exchange()" " gregkh
2025-01-24 19:19 ` [RFC PATCH v6.6 05/10] libfs: Add simple_offset_rename() API cel
2025-01-30  8:59   ` Patch "libfs: Add simple_offset_rename() API" has been added to the 6.6-stable tree gregkh
2025-01-24 19:19 ` [RFC PATCH v6.6 06/10] shmem: Fix shmem_rename2() cel
2025-01-30  8:59   ` Patch "shmem: Fix shmem_rename2()" has been added to the 6.6-stable tree gregkh
2025-01-24 19:19 ` [RFC PATCH v6.6 07/10] libfs: Return ENOSPC when the directory offset range is exhausted cel
2025-01-30  8:59   ` Patch "libfs: Return ENOSPC when the directory offset range is exhausted" has been added to the 6.6-stable tree gregkh
2025-01-24 19:19 ` [RFC PATCH v6.6 08/10] Revert "libfs: Add simple_offset_empty()" cel
2025-01-30  8:59   ` Patch "Revert "libfs: Add simple_offset_empty()"" has been added to the 6.6-stable tree gregkh
2025-01-24 19:19 ` [RFC PATCH v6.6 09/10] libfs: Replace simple_offset end-of-directory detection cel
2025-01-30  8:59   ` Patch "libfs: Replace simple_offset end-of-directory detection" has been added to the 6.6-stable tree gregkh
2025-01-24 19:19 ` [RFC PATCH v6.6 10/10] libfs: Use d_children list to iterate simple_offset directories cel
2025-01-30  8:59   ` Patch "libfs: Use d_children list to iterate simple_offset directories" has been added to the 6.6-stable tree gregkh
2025-01-29 13:55 ` [RFC PATCH v6.6 00/10] Address CVE-2024-46701 Chuck Lever
2025-01-29 14:50   ` Greg Kroah-Hartman
2025-01-29 15:06     ` Chuck Lever
2025-01-29 15:21       ` Greg Kroah-Hartman
2025-01-29 16:37         ` Chuck Lever
2025-01-30  8:45           ` Greg Kroah-Hartman
2025-01-30 14:02             ` Chuck Lever
2025-01-30 14:24               ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250124191946.22308-5-cel@kernel.org \
    --to=cel@kernel.org \
    --cc=akpm@linux-foundation.org \
    --cc=brauner@kernel.org \
    --cc=chuck.lever@oracle.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=hughd@google.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=viro@zeniv.linux.org.uk \
    --cc=yangerkun@huawei.com \
    --cc=yukuai3@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox