On Tue, Mar 21, 2017 at 09:30:30AM -0700, Linus Torvalds wrote:
> On Tue, Mar 21, 2017 at 7:51 AM, Omar Sandoval <osandov@xxxxxxxxxxx> wrote:
> > */
> > -int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry, struct inode **delegated_inode)
> > +int vfs_link(struct dentry *old_dentry, struct inode *dir,
> > + struct dentry *new_dentry, struct inode **delegated_inode,
> > + unsigned int flags)
> > {
> > struct inode *inode = old_dentry->d_inode;
> > + struct inode *target = new_dentry->d_inode;
> > unsigned max_links = dir->i_sb->s_max_links;
> > int error;
> >
> > if (!inode)
> > return -ENOENT;
> >
> > - error = may_create(dir, new_dentry);
> > + if (target) {
> > + if (flags & AT_REPLACE)
> > + error = may_delete(dir, new_dentry, d_is_dir(old_dentry));
> > + else
> > + error = -EEXIST;
> > + } else {
> > + error = may_create(dir, new_dentry);
> > + }
Hi, Linus,
Thanks for taking a look.
> This looks bogus.
>
> In particular, that "may_delete()" cannot be right. It should still
> *also* have the right to create something in that directory.
>
> But even if you replace it with checks for both deletion _and_
> creation, it won't be right, since the test for d_is_negative() on the
> target in may_delete() looks wrong for this situation.
>
> Normally, you cannot delete a negative entry (think of what that would
> do in a overlay situation), but it should still be ok to link a
> positive entry on top of a negative one.
This is actually the exact same check we have in vfs_rename():
----
if (!target) {
error = may_create(new_dir, new_dentry);
} else {
new_is_dir = d_is_dir(new_dentry);
if (!(flags & RENAME_EXCHANGE))
error = may_delete(new_dir, new_dentry, is_dir);
else
error = may_delete(new_dir, new_dentry, new_is_dir);
}
----
I tried to keep the same semantics as rename().
> Also, I think the above is incorrect for yet another case: moving
> somethign on top of a directory should be disallowed. We do later on
> check that the *source* isn't a directory (since you can't link
> directories), but I'm not seeing where you'd be checking that you
> don't move over a directory either.
That check is happening in may_delete():
----
if (isdir) {
if (!d_is_dir(victim))
return -ENOTDIR;
if (IS_ROOT(victim))
return -EBUSY;
} else if (d_is_dir(victim))
return -EISDIR;
----
> So I don't think this patch is acceptable as such. I also suspect that
> it should be done in multiple phases.
>
> Linus
