On Sun, Apr 06, 2025 at 09:43:02PM +0100, Tingmao Wang wrote:
> +bool ino_path_compare(struct v9fs_ino_path *ino_path,
> + struct dentry *dentry)
> +{
> + struct dentry *curr = dentry;
> + struct qstr *curr_name;
> + struct name_snapshot *compare;
> + ssize_t i;
> +
> + lockdep_assert_held_read(&v9fs_dentry2v9ses(dentry)->rename_sem);
> +
> + rcu_read_lock();
> + for (i = ino_path->nr_components - 1; i >= 0; i--) {
> + if (curr->d_parent == curr) {
> + /* We're supposed to have more components to walk */
> + rcu_read_unlock();
> + return false;
> + }
> + curr_name = &curr->d_name;
> + compare = &ino_path->names[i];
> + /*
> + * We can't use hash_len because it is salted with the parent
> + * dentry pointer. We could make this faster by pre-computing our
> + * own hashlen for compare and ino_path outside, probably.
> + */
> + if (curr_name->len != compare->name.len) {
> + rcu_read_unlock();
> + return false;
> + }
> + if (strncmp(curr_name->name, compare->name.name,
> + curr_name->len) != 0) {
... without any kind of protection for curr_name. Incidentally,
what about rename()? Not a cross-directory one, just one that
changes the name of a subdirectory within the same parent?
