ubifs: Fix O_TMPFILE corner case in ubifs_link()

32fe905c · Richard Weinberger <[email protected]> · 2017-03-30 10:50:49 +02:00

It is perfectly fine to link a tmpfile back using linkat().
Since tmpfiles are created with a link count of 0 they appear
on the orphan list, upon re-linking the inode has to be removed
from the orphan list again.

Ralph faced a filesystem corruption in combination with overlayfs
due to this bug.

Cc: <[email protected]>
Cc: Ralph Sennhauser <[email protected]>
Cc: Amir Goldstein <[email protected]>
Reported-by: Ralph Sennhauser <[email protected]>
Tested-by: Ralph Sennhauser <[email protected]>
Reported-by: Amir Goldstein <[email protected]>
Fixes: 474b93704f321 ("ubifs: Implement O_TMPFILE")
Signed-off-by: Richard Weinberger <[email protected]>

Commit: 32fe905c17f001c0eee13c59afddd0bf2eed509c
Parents: c3d9fda6

Changes

1 files changed · +7 −0

File	Status	Add	Del	Content
fs/ubifs/dir.c	modified	+7	−0	View file

fs/ubifs/dir.c

View file

diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index 0858213..b777bdd 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -748,6 +748,11 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir,
 		goto out_fname;
 
 	lock_2_inodes(dir, inode);
+
+	/* Handle O_TMPFILE corner case, it is allowed to link a O_TMPFILE. */
+	if (inode->i_nlink == 0)
+		ubifs_delete_orphan(c, inode->i_ino);
+
 	inc_nlink(inode);
 	ihold(inode);
 	inode->i_ctime = ubifs_current_time(inode);
@@ -768,6 +773,8 @@ out_cancel:
 	dir->i_size -= sz_change;
 	dir_ui->ui_size = dir->i_size;
 	drop_nlink(inode);
+	if (inode->i_nlink == 0)
+		ubifs_add_orphan(c, inode->i_ino);
 	unlock_2_inodes(dir, inode);
 	ubifs_release_budget(c, &req);
 	iput(inode);