samsung_sm8750/android_kernel_samsung_sm8750
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

path_overmount(): avoid false negatives

Browse Source 
[ Upstream commit 5f31c549382bcddbbd754c72c5433b19420d485d ]

Holding namespace_sem is enough to make sure that result remains valid.
It is *not* enough to avoid false negatives from __lookup_mnt().  Mounts
can be unhashed outside of namespace_sem (stuck children getting detached
on final mntput() of lazy-umounted mount) and having an unrelated mount
removed from the hash chain while we traverse it may end up with false
negative from __lookup_mnt().  We need to sample and recheck the seqlock
component of mount_lock...

Bug predates the introduction of path_overmount() - it had come from
the code in finish_automount() that got abstracted into that helper.

Reviewed-by: Christian Brauner <brauner@kernel.org>
Fixes: 26df6034fd ("fix automount/automount race properly")
Fixes: 6ac3928156 ("fs: allow to mount beneath top mount")
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Al Viro
2025-06-01 14:02:26 -04:00
committed by Greg Kroah-Hartman
parent 3aed255ae4
commit 3b699b9472
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
fs/namespace.c
View File

@@ -3020,18 +3020,25 @@ out:
* Check if path is overmounted, i.e., if there's a mount on top of
* @path->mnt with @path->dentry as mountpoint.
*
* Context: This function expects namespace_lock() to be held.
* Context: namespace_sem must be held at least shared.
* MUST NOT be called under lock_mount_hash() (there one should just
* call __lookup_mnt() and check if it returns NULL).
* Return: If path is overmounted true is returned, false if not.
*/
static inline bool path_overmounted(const struct path *path)
{
unsigned seq = read_seqbegin(&mount_lock);
bool no_child;
rcu_read_lock();
if (unlikely(__lookup_mnt(path->mnt, path->dentry))) {
rcu_read_unlock();
return true;
}
no_child = !__lookup_mnt(path->mnt, path->dentry);
rcu_read_unlock();
return false;
if (need_seqretry(&mount_lock, seq)) {
read_seqlock_excl(&mount_lock);
no_child = !__lookup_mnt(path->mnt, path->dentry);
read_sequnlock_excl(&mount_lock);
}
return unlikely(!no_child);
}
/**