On Fri, 2021-04-09 at 16:26 +0800, Ian Kent wrote:
> On Fri, 2021-04-09 at 01:35 +0000, Al Viro wrote:
> > On Fri, Apr 09, 2021 at 09:15:06AM +0800, Ian Kent wrote:
> > > + parent = kernfs_dentry_node(dentry->d_parent);
> > > + if (parent) {
> > > + const void *ns = NULL;
> > > +
> > > + if (kernfs_ns_enabled(parent))
> > > + ns = kernfs_info(dentry->d_parent-
> > > > d_sb)->ns;
> >
> > For any dentry d, we have d->d_parent->d_sb == d->d_sb. All
> > the time.
> > If you ever run into the case where that would not be true, you've
> > found
> > a critical bug.
>
> Right, yes.
>
> > > + kn = kernfs_find_ns(parent, dentry-
> > > > d_name.name, ns);
> > > + if (kn)
> > > + goto out_bad;
> > > + }
> >
> > Umm... What's to prevent a race with successful rename(2)? IOW,
> > what's
> > there to stabilize ->d_parent and ->d_name while we are in that
> > function?
>
> Indeed, glad you looked at this.
>
> Now I'm wondering how kerfs_iop_rename() protects itself from
> concurrent kernfs_rename_ns() ...
As I thought ... I haven't done an exhaustive search but I can't find
any file system that doesn't call back into kernfs from
kernfs_syscall_ops (if provided at kernfs root creation).
I don't see anything that uses kernfs that defines a .rename() op
but if there was one it would be expected to call back into kernfs
at which point it would block on kernfs_mutex (kernfs_rwsem) until
it's released.
So I don't think there can be changes in this case due to the lock
taken just above the code your questioning.
I need to think a bit about whether the dentry being negative (ie.
not having kernfs node) could allow bad things to happen ...
Or am I misunderstanding the race your pointing out here?
Ian
