locks: use file_inode()

Miklos Szeredi · J. Bruce Fields · commit 6343a2120862 · 2016-07-01T10:24:18.000-04:00
(Another one for the f_path debacle.) ltp fcntl33 testcase caused an Oops in selinux_file_send_sigiotask. The reason is that generic_add_lease() used filp->f_path.dentry->inode while all the others use file_inode(). This makes a difference for files opened on overlayfs since the former will point to the overlay inode the latter to the underlying inode. So generic_add_lease() added the lease to the overlay inode and generic_delete_lease() removed it from the underlying inode. When the file was released the lease remained on the overlay inode's lock list, resulting in use after free. Reported-by: Eryu Guan <eguan@redhat.com> Fixes: 4bacc9c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay") Cc: <stable@vger.kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Reviewed-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
diff --git a/fs/locks.c b/fs/locks.c
@@ -1628,7 +1628,7 @@ generic_add_lease(struct file *filp, long arg, struct file_lock **flp, void **pr
 {
 	struct file_lock *fl, *my_fl = NULL, *lease;
 	struct dentry *dentry = filp->f_path.dentry;
-	struct inode *inode = dentry->d_inode;
+	struct inode *inode = file_inode(filp);
 	struct file_lock_context *ctx;
 	bool is_deleg = (*flp)->fl_flags & FL_DELEG;
 	int error;

Original file line number	Diff line number	Diff line change
`@@ -1628,7 +1628,7 @@ generic_add_lease(struct file filp, long arg, struct file_lock flp, void *pr`
`1628`	`1628`	`{`
`1629`	`1629`	`struct file_lock fl, my_fl = NULL, *lease;`
`1630`	`1630`	`struct dentry *dentry = filp->f_path.dentry;`
`1631`		`- struct inode *inode = dentry->d_inode;`
	`1631`	`+ struct inode *inode = file_inode(filp);`
`1632`	`1632`	`struct file_lock_context *ctx;`
`1633`	`1633`	`bool is_deleg = (*flp)->fl_flags & FL_DELEG;`
`1634`	`1634`	`int error;`