Hello,
Applied, thanks!
Samuel
Milos Nikic, le mar. 27 oct. 2026 21:32:21 -0700, a ecrit:
> Hello,
>
> Three small libdiskfs fixes, independent of the journal work.
>
> Patch 1: two more exits in diskfs_rename_dir with the bug fixed in
> 117ad2e56. I missed them then, as they come before the lookup that
> locks the directory being moved, but they unlock it all the same. Any
> user hits it by renaming a directory into one they cannot write:
>
> $ mkdir ~/d && mv ~/d /usr/
>
> That unlocks a free mutex, which goes unnoticed; a thread holding it
> at that moment would lose its lock.
>
> Patch 2: a directory that was removed but is still held (a process's
> working directory, an open port) accepts new names. The file entered
> is reachable from nowhere, and once the directory goes, e2fsck reports
> it as an unattached inode:
>
> $ mkdir /tmp/d && cd /tmp/d && rmdir /tmp/d && touch x; echo $?
> 0
>
> With the patch the create fails with ENOENT, as on Linux. A rename
> into such a directory is refused too, before ".." is rewritten.
>
> Patch 3: on a filesystem mounted with -s, a create that fails (no
> space, no free inode) called diskfs_file_update with a null node and
> killed the translator.
>
> Thanks,
> Milos
>
> Milos Nikic (3):
> libdiskfs: Do not unlock the directory being moved before locking it
> libdiskfs: Do not enter names in a removed directory
> libdiskfs: Do not update a node that a failed create did not make
>
> libdiskfs/dir-lookup.c | 4 +++-
> libdiskfs/dir-renamed.c | 14 +++++++++++++-
> libdiskfs/direnter.c | 9 +++++++++
> 3 files changed, 25 insertions(+), 2 deletions(-)
>
> --
> 2.56.0
>
--
Samuel
/*
* Oops. The kernel tried to access some bad page. We'll have to
* terminate things with extreme prejudice.
*/
die_if_kernel("Oops", regs, error_code);
(From linux/arch/i386/mm/fault.c)
