fs/fhandle.c: fix a race in call of has_locked_children()
authorAl Viro <viro@zeniv.linux.org.uk>
Sun, 1 Jun 2025 18:23:52 +0000 (14:23 -0400)
committerAl Viro <viro@zeniv.linux.org.uk>
Sat, 7 Jun 2025 04:37:38 +0000 (00:37 -0400)
commit1f282cdc1d219c4a557f7009e81bc792820d9d9a
tree06c228aaf056a1e93d2fb6f353bc780c8a06cbbe
parenta82ba839915926f8713183fd023c6d9357bae26c
fs/fhandle.c: fix a race in call of has_locked_children()

may_decode_fh() is calling has_locked_children() while holding no locks.
That's an oopsable race...

The rest of the callers are safe since they are holding namespace_sem and
are guaranteed a positive refcount on the mount in question.

Rename the current has_locked_children() to __has_locked_children(), make
it static and switch the fs/namespace.c users to it.

Make has_locked_children() a wrapper for __has_locked_children(), calling
the latter under read_seqlock_excl(&mount_lock).

Reviewed-by: Christian Brauner <brauner@kernel.org>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Fixes: 620c266f3949 ("fhandle: relax open_by_handle_at() permission checks")
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/namespace.c