use-dget_parent-in-ext4_file_open

   1 ext4: use dget_parent() in ext4_file_open()
   2
   3 From: Miklos Szeredi <mszeredi@redhat.com>
   4
   5 In f_op->open() lock on parent is not held, so there's no guarantee that
   6 parent dentry won't go away at any time.
   7
   8 Even after this patch there's no guarantee that 'dir' will stay the parent
   9 of 'inode', but at least it won't be freed while being used.
  10
  11 Fixes: ff978b09f973 ("ext4 crypto: move context consistency check to ext4_file_open()")
  12 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
  13 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
  14 Cc: <stable@vger.kernel.org> # v4.5
  15 ---
  16  fs/ext4/file.c | 12 ++++++++----
  17  1 file changed, 8 insertions(+), 4 deletions(-)
  18
  19 diff --git a/fs/ext4/file.c b/fs/ext4/file.c
  20 index 4cd318f31cbe..feb9ffc6f20d 100644
  21 --- a/fs/ext4/file.c
  22 +++ b/fs/ext4/file.c
  23 @@ -335,7 +335,7 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
  24         struct super_block *sb = inode->i_sb;
  25         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
  26         struct vfsmount *mnt = filp->f_path.mnt;
  27 -       struct inode *dir = filp->f_path.dentry->d_parent->d_inode;
  28 +       struct dentry *dir;
  29         struct path path;
  30         char buf[64], *cp;
  31         int ret;
  32 @@ -379,14 +379,18 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
  33                 if (ext4_encryption_info(inode) == NULL)
  34                         return -ENOKEY;
  35         }
  36 -       if (ext4_encrypted_inode(dir) &&
  37 -           !ext4_is_child_context_consistent_with_parent(dir, inode)) {
  38 +
  39 +       dir = dget_parent(filp->f_path.dentry);
  40 +       if (ext4_encrypted_inode(d_inode(dir)) &&
  41 +           !ext4_is_child_context_consistent_with_parent(d_inode(dir), inode)) {
  42                 ext4_warning(inode->i_sb,
  43                              "Inconsistent encryption contexts: %lu/%lu\n",
  44 -                            (unsigned long) dir->i_ino,
  45 +                            (unsigned long) d_inode(dir)->i_ino,
  46                              (unsigned long) inode->i_ino);
  47 +               dput(dir);
  48                 return -EPERM;
  49         }
  50 +       dput(dir);
  51         /*
  52          * Set up the jbd2_inode if we are opening the inode for
  53          * writing and the journal is present
  54 --
  55 2.1.4
  56
  57