locks: eliminate false positive conflicts for write lease

check_conflicting_open() is checking for existing fd's open for read or
for write before allowing to take a write lease.  The check that was
implemented using i_count and d_count is an approximation that has
several false positives.  For example, overlayfs since v4.19, takes an
extra reference on the dentry; An open with O_PATH takes a reference on
the dentry although the file cannot be read nor written.

Change the implementation to use i_readcount and i_writecount to
eliminate the false positive conflicts and allow a write lease to be
taken on an overlayfs file.

The change of behavior with existing fd's open with O_PATH is symmetric
w.r.t. current behavior of lease breakers - an open with O_PATH currently
does not break a write lease.

This increases the size of struct inode by 4 bytes on 32bit archs when
CONFIG_FILE_LOCKING is defined and CONFIG_IMA was not already
defined.

Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>

diff --git a/fs/locks.c b/fs/locks.c
index 0cc2b9f..de87a32 100644 (file)
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1763,10 +1763,10 @@ int fcntl_getlease(struct file *filp)
 }
 
 /**
- * check_conflicting_open - see if the given dentry points to a file that has
+ * check_conflicting_open - see if the given file points to an inode that has
  *                         an existing open that would conflict with the
  *                         desired lease.
- * @dentry:    dentry to check
+ * @filp:      file to check
  * @arg:       type of lease that we're trying to acquire
  * @flags:     current lock flags
  *
@@ -1774,30 +1774,42 @@ int fcntl_getlease(struct file *filp)
  * conflict with the lease we're trying to set.
  */
 static int
-check_conflicting_open(const struct dentry *dentry, const long arg, int flags)
+check_conflicting_open(struct file *filp, const long arg, int flags)
 {
-       int ret = 0;
-       struct inode *inode = dentry->d_inode;
+       struct inode *inode = locks_inode(filp);
+       int self_wcount = 0, self_rcount = 0;
 
        if (flags & FL_LAYOUT)
                return 0;
 
-       if ((arg == F_RDLCK) && inode_is_open_for_write(inode))
-               return -EAGAIN;
+       if (arg == F_RDLCK)
+               return inode_is_open_for_write(inode) ? -EAGAIN : 0;
+       else if (arg != F_WRLCK)
+               return 0;
+
+       /*
+        * Make sure that only read/write count is from lease requestor.
+        * Note that this will result in denying write leases when i_writecount
+        * is negative, which is what we want.  (We shouldn't grant write leases
+        * on files open for execution.)
+        */
+       if (filp->f_mode & FMODE_WRITE)
+               self_wcount = 1;
+       else if (filp->f_mode & FMODE_READ)
+               self_rcount = 1;
 
-       if ((arg == F_WRLCK) && ((d_count(dentry) > 1) ||
-           (atomic_read(&inode->i_count) > 1)))
-               ret = -EAGAIN;
+       if (atomic_read(&inode->i_writecount) != self_wcount ||
+           atomic_read(&inode->i_readcount) != self_rcount)
+               return -EAGAIN;
 
-       return ret;
+       return 0;
 }
 
 static int
 generic_add_lease(struct file *filp, long arg, struct file_lock **flp, void **priv)
 {
        struct file_lock *fl, *my_fl = NULL, *lease;
-       struct dentry *dentry = filp->f_path.dentry;
-       struct inode *inode = dentry->d_inode;
+       struct inode *inode = locks_inode(filp);
        struct file_lock_context *ctx;
        bool is_deleg = (*flp)->fl_flags & FL_DELEG;
        int error;
@@ -1832,7 +1844,7 @@ generic_add_lease(struct file *filp, long arg, struct file_lock **flp, void **pr
        percpu_down_read(&file_rwsem);
        spin_lock(&ctx->flc_lock);
        time_out_leases(inode, &dispose);
-       error = check_conflicting_open(dentry, arg, lease->fl_flags);
+       error = check_conflicting_open(filp, arg, lease->fl_flags);
        if (error)
                goto out;
 
@@ -1889,7 +1901,7 @@ generic_add_lease(struct file *filp, long arg, struct file_lock **flp, void **pr
         * precedes these checks.
         */
        smp_mb();
-       error = check_conflicting_open(dentry, arg, lease->fl_flags);
+       error = check_conflicting_open(filp, arg, lease->fl_flags);
        if (error) {
                locks_unlink_lock_ctx(lease);
                goto out;

diff --git a/include/linux/fs.h b/include/linux/fs.h
index f7fdfe9..419e327 100644 (file)
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -694,7 +694,7 @@ struct inode {
        atomic_t                i_count;
        atomic_t                i_dio_count;
        atomic_t                i_writecount;
-#ifdef CONFIG_IMA
+#if defined(CONFIG_IMA) || defined(CONFIG_FILE_LOCKING)
        atomic_t                i_readcount; /* struct files open RO */
 #endif
        union {
@@ -2890,7 +2890,7 @@ static inline bool inode_is_open_for_write(const struct inode *inode)
        return atomic_read(&inode->i_writecount) > 0;
 }
 
-#ifdef CONFIG_IMA
+#if defined(CONFIG_IMA) || defined(CONFIG_FILE_LOCKING)
 static inline void i_readcount_dec(struct inode *inode)
 {
        BUG_ON(!atomic_read(&inode->i_readcount));