Once created, a kernfs_node is always destroyed by kernfs_put().
Since ba7443bc65 ("sysfs, kernfs: implement
kernfs_create/destroy_root()"), kernfs_put() depends on kernfs_root()
to locate the ino_ida.  kernfs_root() in turn depends on
kernfs_node->parent being set for !dir nodes.  This means that
kernfs_put() of a !dir node requires its ->parent to be initialized.
This leads to oops when a newly created !dir node is destroyed without
going through kernfs_add_one() or after failing kernfs_add_one()
before ->parent is set.  kernfs_root() invoked from kernfs_put() will
try to dereference NULL parent.
Fix it by moving parent association to kernfs_new_node() from
kernfs_add_one().  kernfs_new_node() now takes @parent instead of
@root and determines the root from the parent and also sets the new
node's parent properly.  @parent parameter is removed from
kernfs_add_one().  As there's no parent when creating the root node,
__kernfs_new_node() which takes @root as before and doesn't set the
parent is used in that case.
This ensures that a kernfs_node in any stage in its life has its
parent associated and thus can be put.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
		
	
			
		
			
				
	
	
		
			151 lines
		
	
	
	
		
			3.4 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			151 lines
		
	
	
	
		
			3.4 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
/*
 | 
						|
 * fs/kernfs/symlink.c - kernfs symlink implementation
 | 
						|
 *
 | 
						|
 * Copyright (c) 2001-3 Patrick Mochel
 | 
						|
 * Copyright (c) 2007 SUSE Linux Products GmbH
 | 
						|
 * Copyright (c) 2007, 2013 Tejun Heo <tj@kernel.org>
 | 
						|
 *
 | 
						|
 * This file is released under the GPLv2.
 | 
						|
 */
 | 
						|
 | 
						|
#include <linux/fs.h>
 | 
						|
#include <linux/gfp.h>
 | 
						|
#include <linux/namei.h>
 | 
						|
 | 
						|
#include "kernfs-internal.h"
 | 
						|
 | 
						|
/**
 | 
						|
 * kernfs_create_link - create a symlink
 | 
						|
 * @parent: directory to create the symlink in
 | 
						|
 * @name: name of the symlink
 | 
						|
 * @target: target node for the symlink to point to
 | 
						|
 *
 | 
						|
 * Returns the created node on success, ERR_PTR() value on error.
 | 
						|
 */
 | 
						|
struct kernfs_node *kernfs_create_link(struct kernfs_node *parent,
 | 
						|
				       const char *name,
 | 
						|
				       struct kernfs_node *target)
 | 
						|
{
 | 
						|
	struct kernfs_node *kn;
 | 
						|
	struct kernfs_addrm_cxt acxt;
 | 
						|
	int error;
 | 
						|
 | 
						|
	kn = kernfs_new_node(parent, name, S_IFLNK|S_IRWXUGO, KERNFS_LINK);
 | 
						|
	if (!kn)
 | 
						|
		return ERR_PTR(-ENOMEM);
 | 
						|
 | 
						|
	if (kernfs_ns_enabled(parent))
 | 
						|
		kn->ns = target->ns;
 | 
						|
	kn->symlink.target_kn = target;
 | 
						|
	kernfs_get(target);	/* ref owned by symlink */
 | 
						|
 | 
						|
	kernfs_addrm_start(&acxt);
 | 
						|
	error = kernfs_add_one(&acxt, kn);
 | 
						|
	kernfs_addrm_finish(&acxt);
 | 
						|
 | 
						|
	if (!error)
 | 
						|
		return kn;
 | 
						|
 | 
						|
	kernfs_put(kn);
 | 
						|
	return ERR_PTR(error);
 | 
						|
}
 | 
						|
 | 
						|
static int kernfs_get_target_path(struct kernfs_node *parent,
 | 
						|
				  struct kernfs_node *target, char *path)
 | 
						|
{
 | 
						|
	struct kernfs_node *base, *kn;
 | 
						|
	char *s = path;
 | 
						|
	int len = 0;
 | 
						|
 | 
						|
	/* go up to the root, stop at the base */
 | 
						|
	base = parent;
 | 
						|
	while (base->parent) {
 | 
						|
		kn = target->parent;
 | 
						|
		while (kn->parent && base != kn)
 | 
						|
			kn = kn->parent;
 | 
						|
 | 
						|
		if (base == kn)
 | 
						|
			break;
 | 
						|
 | 
						|
		strcpy(s, "../");
 | 
						|
		s += 3;
 | 
						|
		base = base->parent;
 | 
						|
	}
 | 
						|
 | 
						|
	/* determine end of target string for reverse fillup */
 | 
						|
	kn = target;
 | 
						|
	while (kn->parent && kn != base) {
 | 
						|
		len += strlen(kn->name) + 1;
 | 
						|
		kn = kn->parent;
 | 
						|
	}
 | 
						|
 | 
						|
	/* check limits */
 | 
						|
	if (len < 2)
 | 
						|
		return -EINVAL;
 | 
						|
	len--;
 | 
						|
	if ((s - path) + len > PATH_MAX)
 | 
						|
		return -ENAMETOOLONG;
 | 
						|
 | 
						|
	/* reverse fillup of target string from target to base */
 | 
						|
	kn = target;
 | 
						|
	while (kn->parent && kn != base) {
 | 
						|
		int slen = strlen(kn->name);
 | 
						|
 | 
						|
		len -= slen;
 | 
						|
		strncpy(s + len, kn->name, slen);
 | 
						|
		if (len)
 | 
						|
			s[--len] = '/';
 | 
						|
 | 
						|
		kn = kn->parent;
 | 
						|
	}
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int kernfs_getlink(struct dentry *dentry, char *path)
 | 
						|
{
 | 
						|
	struct kernfs_node *kn = dentry->d_fsdata;
 | 
						|
	struct kernfs_node *parent = kn->parent;
 | 
						|
	struct kernfs_node *target = kn->symlink.target_kn;
 | 
						|
	int error;
 | 
						|
 | 
						|
	mutex_lock(&kernfs_mutex);
 | 
						|
	error = kernfs_get_target_path(parent, target, path);
 | 
						|
	mutex_unlock(&kernfs_mutex);
 | 
						|
 | 
						|
	return error;
 | 
						|
}
 | 
						|
 | 
						|
static void *kernfs_iop_follow_link(struct dentry *dentry, struct nameidata *nd)
 | 
						|
{
 | 
						|
	int error = -ENOMEM;
 | 
						|
	unsigned long page = get_zeroed_page(GFP_KERNEL);
 | 
						|
	if (page) {
 | 
						|
		error = kernfs_getlink(dentry, (char *) page);
 | 
						|
		if (error < 0)
 | 
						|
			free_page((unsigned long)page);
 | 
						|
	}
 | 
						|
	nd_set_link(nd, error ? ERR_PTR(error) : (char *)page);
 | 
						|
	return NULL;
 | 
						|
}
 | 
						|
 | 
						|
static void kernfs_iop_put_link(struct dentry *dentry, struct nameidata *nd,
 | 
						|
				void *cookie)
 | 
						|
{
 | 
						|
	char *page = nd_get_link(nd);
 | 
						|
	if (!IS_ERR(page))
 | 
						|
		free_page((unsigned long)page);
 | 
						|
}
 | 
						|
 | 
						|
const struct inode_operations kernfs_symlink_iops = {
 | 
						|
	.setxattr	= kernfs_iop_setxattr,
 | 
						|
	.removexattr	= kernfs_iop_removexattr,
 | 
						|
	.getxattr	= kernfs_iop_getxattr,
 | 
						|
	.listxattr	= kernfs_iop_listxattr,
 | 
						|
	.readlink	= generic_readlink,
 | 
						|
	.follow_link	= kernfs_iop_follow_link,
 | 
						|
	.put_link	= kernfs_iop_put_link,
 | 
						|
	.setattr	= kernfs_iop_setattr,
 | 
						|
	.getattr	= kernfs_iop_getattr,
 | 
						|
	.permission	= kernfs_iop_permission,
 | 
						|
};
 |