On Mon, Mar 18, 2019 at 01:29:49PM -0700, Eric Biggers wrote: > On Sun, Mar 17, 2019 at 08:38:22PM +0000, Al Viro wrote: > > On Sun, Mar 17, 2019 at 01:04:40PM -0700, Eric Biggers wrote: > > > + /* > > > + * Ciphertext name; valid if the directory's key is still unavailable. > > > + * > > > + * Note: since fscrypt forbids rename() on ciphertext names, it should > > > + * be safe to access ->d_parent directly here. > > > > No, it is not. Again, d_splice_alias() on buggered fs image picking a reference > > to your subdirectory when doing a lookup elsewhere. It can relocate the > > damn thing, without rename() being allowed for _anything_. > > You're talking about directory hard links, right? In case of corrupted fs image - yes; the same can happen if you have a network filesystem with subdirectory moved around on server at the same time, but there you'll need a lot more elaborate ->d_revalidate() anyway. Directory hardlinks are certainly not allowed; however, we need the kernel to survive when it runs into that kind of crap on disk...
