From 26115521a3cb3418a516ed0e7ddf81564da26879 Mon Sep 17 00:00:00 2001 From: ChenXiaoSong Date: Wed, 28 Jun 2023 03:00:36 +0000 Subject: [PATCH 1/2] hmdfs: prohibit renaming cross-view for cloud merge If rename file between different view, it will trigger use-after-free. Fix this by probibiting cross-view rename. Signed-off-by: ChenXiaoSong --- fs/hmdfs/inode_cloud_merge.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/hmdfs/inode_cloud_merge.c b/fs/hmdfs/inode_cloud_merge.c index e4e456632776..8e107d795ed5 100644 --- a/fs/hmdfs/inode_cloud_merge.c +++ b/fs/hmdfs/inode_cloud_merge.c @@ -632,6 +632,13 @@ static int hmdfs_rename_cloud_merge(struct inode *old_dir, ret = -EACCES; goto rename_out; } + + if (hmdfs_i(old_dir)->inode_type != hmdfs_i(new_dir)->inode_type) { + hmdfs_err("in different view"); + ret = -EPERM; + goto rename_out; + } + if (hmdfs_d(old_dentry)->device_id != hmdfs_d(new_dentry)->device_id) { ret = -EXDEV; goto rename_out; -- Gitee From 0c69b6ba88e7144e8f2015f9a1af17faf1a27027 Mon Sep 17 00:00:00 2001 From: ChenXiaoSong Date: Thu, 29 Jun 2023 02:38:29 +0000 Subject: [PATCH 2/2] hmdfs: remove redundant hmdfs_trace_rename_merge() Info of trace_hmdfs_rename_merge() is enough, remove the redundant trace. Signed-off-by: ChenXiaoSong --- fs/hmdfs/hmdfs_merge_view.h | 17 ----------------- fs/hmdfs/inode_cloud_merge.c | 1 - 2 files changed, 18 deletions(-) diff --git a/fs/hmdfs/hmdfs_merge_view.h b/fs/hmdfs/hmdfs_merge_view.h index aeda4127d1cc..fcc469c1484f 100644 --- a/fs/hmdfs/hmdfs_merge_view.h +++ b/fs/hmdfs/hmdfs_merge_view.h @@ -203,23 +203,6 @@ static inline bool is_merge_lookup_end(struct hmdfs_dentry_info_merge *mdi) } \ } -#define hmdfs_trace_rename_merge(olddir, olddentry, newdir, newdentry, err) \ - { \ - struct hmdfs_dentry_comrade *comrade; \ - trace_hmdfs_rename_merge(olddir, olddentry, newdir, newdentry, \ - err); \ - mutex_lock(&hmdfs_dm(olddentry)->comrade_list_lock); \ - for_each_comrade_locked(olddentry, comrade) \ - trace_hmdfs_show_comrade(olddentry, comrade->lo_d, \ - comrade->dev_id); \ - mutex_unlock(&hmdfs_dm(olddentry)->comrade_list_lock); \ - mutex_lock(&hmdfs_dm(newdentry)->comrade_list_lock); \ - for_each_comrade_locked(newdentry, comrade) \ - trace_hmdfs_show_comrade(newdentry, comrade->lo_d, \ - comrade->dev_id); \ - mutex_unlock(&hmdfs_dm(newdentry)->comrade_list_lock); \ - } - /***************************************************************************** * Helper functions abstarcting out comrade *****************************************************************************/ diff --git a/fs/hmdfs/inode_cloud_merge.c b/fs/hmdfs/inode_cloud_merge.c index 8e107d795ed5..4d8e822ac189 100644 --- a/fs/hmdfs/inode_cloud_merge.c +++ b/fs/hmdfs/inode_cloud_merge.c @@ -660,7 +660,6 @@ static int hmdfs_rename_cloud_merge(struct inode *old_dir, if (S_ISREG(old_dentry->d_inode->i_mode) && !ret) d_invalidate(old_dentry); rename_out: - hmdfs_trace_rename_merge(old_dir, old_dentry, new_dir, new_dentry, ret); kfree(rec_op_para); return ret; } -- Gitee