ovl: fix use inode directly in rcu-walk mode

ovl_dentry_revalidate_common() can be called in rcu-walk mode.  As document
said, "in rcu-walk mode, d_parent and d_inode should not be used without
care".

Check inode here to protect access under rcu-walk mode.

Fixes: bccece1ead36 ("ovl: allow remote upper")
Reported-and-tested-by: syzbot+a4055c78774bbf3498bb@syzkaller.appspotmail.com
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Cc: <stable@vger.kernel.org> # v5.7
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index a29a8afe9b26226dd94423e75d3287294a18e25b..3d14a3f1465d1c2a4751371a7ad19bb2aabd7e17 100644 (file)
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -139,11 +139,16 @@ static int ovl_dentry_revalidate_common(struct dentry *dentry,
                                        unsigned int flags, bool weak)
 {
        struct ovl_entry *oe = dentry->d_fsdata;
+       struct inode *inode = d_inode_rcu(dentry);
        struct dentry *upper;
        unsigned int i;
        int ret = 1;
 
-       upper = ovl_dentry_upper(dentry);
+       /* Careful in RCU mode */
+       if (!inode)
+               return -ECHILD;
+
+       upper = ovl_i_dentry_upper(inode);
        if (upper)
                ret = ovl_revalidate_real(upper, flags, weak);