When commit d3556babd7fa ("ocfs2: fix d_splice_alias() return code
checking") was merged into v3.18-rc3, d_splice_alias() was returning
one of a valid dentry, NULL or an ERR_PTR.
But when commit b5ae6b15bd73 ("merge d_materialise_unique() into
d_splice_alias()") was merged into v3.19-rc1, d_splice_alias() started
returning -ELOOP as one of ERR_PTR values.
As a result, when syzkaller mounts a crafted ocfs2 filesystem image that
hits d_splice_alias() == -ELOOP case from ocfs2_lookup(), ocfs2_lookup()
fails to handle -ELOOP case and generic_shutdown_super() hits "VFS: Busy
inodes after unmount" message.
Don't call ocfs2_dentry_attach_lock() nor ocfs2_dentry_attach_gen()
when d_splice_alias() returned -ELOOP.
Reported-by: syzbot <syzbot+1134d3a5b062e9665a7a@xxxxxxxxxxxxxxxxxxxxxxxxx>
Closes: https://syzkaller.appspot.com/bug?extid=1134d3a5b062e9665a7a
Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
---
This patch wants review from maintainers. I'm not familiar with this change.
fs/ocfs2/namei.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 99278c8f0e24..4ccb39f43bc6 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -142,6 +142,8 @@ static struct dentry *ocfs2_lookup(struct inode *dir, struct dentry *dentry,
bail_add:
ret = d_splice_alias(inode, dentry);
+ if (ret == ERR_PTR(-ELOOP))
+ goto bail_unlock;
if (inode) {
/*
--
2.49.0
