Commit bbe6a7c8 authored by Al Viro's avatar Al Viro
Browse files

bch2_ioctl_subvolume_destroy(): fix locking 



make it use user_path_locked_at() to get the normal directory protection
for modifications, as well as stable ->d_parent and ->d_name in victim

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 74d016ec

fs/bcachefs/fs-ioctl.c

+17 −14
Original line number Diff line number Diff line
@@ -453,33 +453,36 @@ static long bch2_ioctl_subvolume_create(struct bch_fs *c, struct file *filp, 
static long bch2_ioctl_subvolume_destroy(struct bch_fs *c, struct file *filp,

				struct bch_ioctl_subvolume arg)

{

	const char __user *name = (void __user *)(unsigned long)arg.dst_ptr;

	struct path path;

	struct inode *dir;

	struct dentry *victim;

	int ret = 0;



	if (arg.flags)

		return -EINVAL;



	ret = user_path_at(arg.dirfd,

			(const char __user *)(unsigned long)arg.dst_ptr,

			LOOKUP_FOLLOW, &path);

	if (ret)

		return ret;

	victim = user_path_locked_at(arg.dirfd, name, &path);

	if (IS_ERR(victim))

		return PTR_ERR(victim);



	if (path.dentry->d_sb->s_fs_info != c) {

	if (victim->d_sb->s_fs_info != c) {

		ret = -EXDEV;

		goto err;

	}



	dir = path.dentry->d_parent->d_inode;



	ret = __bch2_unlink(dir, path.dentry, true);

	if (ret)

	if (!d_is_positive(victim)) {

		ret = -ENOENT;

		goto err;



	fsnotify_rmdir(dir, path.dentry);

	d_delete(path.dentry);

	}

	dir = d_inode(path.dentry);

	ret = __bch2_unlink(dir, victim, true);

	if (!ret) {

		fsnotify_rmdir(dir, victim);

		d_delete(victim);

	}

	inode_unlock(dir);

err:

	dput(victim);

	path_put(&path);

	return ret;

}