Commit 9aab10a0 authored by Sebastian Andrzej Siewior's avatar Sebastian Andrzej Siewior Committed by Greg Kroah-Hartman
Browse files

kernfs: Don't re-lock kernfs_root::kernfs_rwsem in kernfs_fop_readdir(). 



The readdir operation iterates over all entries and invokes dir_emit()
for every entry passing kernfs_node::name as argument.
Since the name argument can change, and become invalid, the
kernfs_root::kernfs_rwsem lock should not be dropped to prevent renames
during the operation.

The lock drop around dir_emit() has been initially introduced in commit
   1e5289c9 ("sysfs: Cache the last sysfs_dirent to improve readdir scalability v2")

to avoid holding a global lock during a page fault. The lock drop is
wrong since the support of renames and not a big burden since the lock
is no longer global.

Don't re-acquire kernfs_root::kernfs_rwsem while copying the name to the
userpace buffer.

Acked-by: default avatarTejun Heo <tj@kernel.org>
Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20250213145023.2820193-5-bigeasy@linutronix.de


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 5b2fabf7

fs/kernfs/dir.c

+3 −3
Original line number Diff line number Diff line
@@ -1869,10 +1869,10 @@ static int kernfs_fop_readdir(struct file *file, struct dir_context *ctx) 
		file->private_data = pos;

		kernfs_get(pos);



		if (!dir_emit(ctx, name, len, ino, type)) {

			up_read(&root->kernfs_rwsem);

		if (!dir_emit(ctx, name, len, ino, type))

			return 0;

		down_read(&root->kernfs_rwsem);

		}

	}

	up_read(&root->kernfs_rwsem);

	file->private_data = NULL;