This is a note to let you know that I've just added the patch titled fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy* to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: fix-handling-of-nd-depth-on-lookup_cached-failures-in-try_to_unlazy.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From b93a6e389bdc72d423e666cbb5475ca7c7c4deb9 Mon Sep 17 00:00:00 2001 From: Al Viro <viro@xxxxxxxxxxxxxxxxxx> Date: Mon, 15 Feb 2021 12:03:23 -0500 Subject: fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy* From: Al Viro <viro@xxxxxxxxxxxxxxxxxx> [ Upstream commit eacd9aa8cedeb412842c7b339adbaa0477fdd5ad ] After switching to non-RCU mode, we want nd->depth to match the number of entries in nd->stack[] that need eventual path_put(). legitimize_links() takes care of that on failures; unfortunately, failure exits added for LOOKUP_CACHED do not. We could add the logics for that into those failure exits, both in try_to_unlazy() and in try_to_unlazy_next(), but since both checks are immediately followed by legitimize_links() and there's no calls of legitimize_links() other than those two... It's easier to move the check (and required handling of nd->depth on failure) into legitimize_links() itself. [caught by Jens: ... and since we are zeroing ->depth here, we need to do drop_links() first] Fixes: 6c6ec2b0a3e0 "fs: add support for LOOKUP_CACHED" Tested-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/namei.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- a/fs/namei.c +++ b/fs/namei.c @@ -630,6 +630,11 @@ static inline bool legitimize_path(struc static bool legitimize_links(struct nameidata *nd) { int i; + if (unlikely(nd->flags & LOOKUP_CACHED)) { + drop_links(nd); + nd->depth = 0; + return false; + } for (i = 0; i < nd->depth; i++) { struct saved *last = nd->stack + i; if (unlikely(!legitimize_path(nd, &last->link, last->seq))) { @@ -686,8 +691,6 @@ static bool try_to_unlazy(struct nameida BUG_ON(!(nd->flags & LOOKUP_RCU)); nd->flags &= ~LOOKUP_RCU; - if (nd->flags & LOOKUP_CACHED) - goto out1; if (unlikely(!legitimize_links(nd))) goto out1; if (unlikely(!legitimize_path(nd, &nd->path, nd->seq))) @@ -724,8 +727,6 @@ static bool try_to_unlazy_next(struct na BUG_ON(!(nd->flags & LOOKUP_RCU)); nd->flags &= ~LOOKUP_RCU; - if (nd->flags & LOOKUP_CACHED) - goto out2; if (unlikely(!legitimize_links(nd))) goto out2; if (unlikely(!legitimize_mnt(nd->path.mnt, nd->m_seq))) Patches currently in stable-queue which might be from viro@xxxxxxxxxxxxxxxxxx are queue-5.10/debugfs-fix-error-when-writing-negative-value-to-ato.patch queue-5.10/saner-calling-conventions-for-unlazy_child.patch queue-5.10/fix-handling-of-nd-depth-on-lookup_cached-failures-in-try_to_unlazy.patch queue-5.10/lib-notifier-error-inject-fix-error-when-writing-err.patch queue-5.10/tools-headers-uapi-sync-openat2.h-with-the-kernel-sources.patch queue-5.10/fs-expose-lookup_cached-through-openat2-resolve_cached.patch queue-5.10/libfs-add-define_simple_attribute_signed-for-signed-.patch queue-5.10/make-sure-nd-path.mnt-and-nd-path.dentry-are-always-valid-pointers.patch queue-5.10/fs-sysv-fix-sysv_nblocks-returns-wrong-value.patch queue-5.10/alpha-fix-syscall-entry-in-audut_syscall-case.patch queue-5.10/alpha-fix-tif_notify_signal-handling.patch queue-5.10/fs-add-support-for-lookup_cached.patch