From: Erez Zadok <ezk@cs.sunysb.edu>
Date: Tue, 22 Sep 2009 21:27:30 +0000 (-0400)
Subject: Unionfs: handle an open-unlink-ftruncate sequence
X-Git-Url: https://git.fsl.cs.sunysb.edu/?a=commitdiff_plain;h=75ad342182fbd7c80d2d9149c5e08b1949670f96;p=unionfs-2.6.39.y.git

Unionfs: handle an open-unlink-ftruncate sequence

If someone calls open(), then unlink(), then ftruncate() on a file (rare,
but possible), then it's possible for unionfs to get an unlinked inode which
doesn't have an inode->i_sb and its inode->i_ino is zero.  Don't oops in
that case.

Signed-off-by: Erez Zadok <ezk@cs.sunysb.edu>
---

diff --git a/fs/unionfs/inode.c b/fs/unionfs/inode.c
index 7e86273583d..bd5a3b33694 100644
--- a/fs/unionfs/inode.c
+++ b/fs/unionfs/inode.c
@@ -835,7 +835,7 @@ static int unionfs_permission(struct inode *inode, int mask)
 		if (err && err != -EACCES && err != EPERM && bindex > 0) {
 			umode_t mode = lower_inode->i_mode;
 			if ((is_robranch_super(inode->i_sb, bindex) ||
-			     IS_RDONLY(lower_inode)) &&
+			     __is_rdonly(lower_inode)) &&
 			    (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
 				err = 0;
 			if (IS_COPYUP_ERR(err))
@@ -930,7 +930,7 @@ static int unionfs_setattr(struct dentry *dentry, struct iattr *ia)
 
 	/* copyup if the file is on a read only branch */
 	if (is_robranch_super(dentry->d_sb, bstart)
-	    || IS_RDONLY(lower_inode)) {
+	    || __is_rdonly(lower_inode)) {
 		/* check if we have a branch to copy up to */
 		if (bstart <= 0) {
 			err = -EACCES;
@@ -977,14 +977,20 @@ static int unionfs_setattr(struct dentry *dentry, struct iattr *ia)
 	}
 
 	/* notify the (possibly copied-up) lower inode */
-	mutex_lock(&lower_inode->i_mutex);
+	/*
+	 * Note: we use lower_dentry->d_inode, because lower_inode may be
+	 * unlinked (no inode->i_sb and i_ino==0.  This happens if someone
+	 * tries to open(), unlink(), then ftruncate() a file.
+	 */
+	mutex_lock(&lower_dentry->d_inode->i_mutex);
 	err = notify_change(lower_dentry, ia);
-	mutex_unlock(&lower_inode->i_mutex);
+	mutex_unlock(&lower_dentry->d_inode->i_mutex);
 	if (err)
 		goto out;
 
 	/* get attributes from the first lower inode */
-	unionfs_copy_attr_all(inode, lower_inode);
+	if (ibstart(inode) >= 0)
+		unionfs_copy_attr_all(inode, lower_inode);
 	/*
 	 * unionfs_copy_attr_all will copy the lower times to our inode if
 	 * the lower ones are newer (useful for cache coherency).  However,
diff --git a/fs/unionfs/union.h b/fs/unionfs/union.h
index 1a05f63c5f9..17a00567dab 100644
--- a/fs/unionfs/union.h
+++ b/fs/unionfs/union.h
@@ -485,6 +485,15 @@ static inline int set_branchperms(struct super_block *sb, int index, int perms)
 	return perms;
 }
 
+/* check if readonly lower inode, but possibly unlinked (no inode->i_sb) */
+static inline int __is_rdonly(const struct inode *inode)
+{
+	/* if unlinked, can't be readonly (?) */
+	if (!inode->i_sb)
+		return 0;
+	return IS_RDONLY(inode);
+
+}
 /* Is this file on a read-only branch? */
 static inline int is_robranch_super(const struct super_block *sb, int index)
 {