exportfs: do not read dentry after free

SinkFinder · Al Viro · commit 2084ac6c505a · 2018-11-23T09:08:17.000-05:00
The function dentry_connected calls dput(dentry) to drop the previously acquired reference to dentry. In this case, dentry can be released. After that, IS_ROOT(dentry) checks the condition (dentry == dentry->d_parent), which may result in a use-after-free bug. This patch directly compares dentry with its parent obtained before dropping the reference. Fixes: a056cc8("exportfs: stop retrying once we race with rename/remove") Signed-off-by: Pan Bian <bianpan2016@163.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
@@ -77,7 +77,7 @@ static bool dentry_connected(struct dentry *dentry)
 		struct dentry *parent = dget_parent(dentry);
 
 		dput(dentry);
-		if (IS_ROOT(dentry)) {
+		if (dentry == parent) {
 			dput(parent);
 			return false;
 		}

Original file line number	Diff line number	Diff line change
`@@ -77,7 +77,7 @@ static bool dentry_connected(struct dentry *dentry)`
`77`	`77`	`struct dentry *parent = dget_parent(dentry);`
`78`	`78`
`79`	`79`	`dput(dentry);`
`80`		`- if (IS_ROOT(dentry)) {`
	`80`	`+ if (dentry == parent) {`
`81`	`81`	`dput(parent);`
`82`	`82`	`return false;`
`83`	`83`	`}`