Hello, Three small libdiskfs fixes, independent of the journal work.
Patch 1: two more exits in diskfs_rename_dir with the bug fixed in 117ad2e56. I missed them then, as they come before the lookup that locks the directory being moved, but they unlock it all the same. Any user hits it by renaming a directory into one they cannot write: $ mkdir ~/d && mv ~/d /usr/ That unlocks a free mutex, which goes unnoticed; a thread holding it at that moment would lose its lock. Patch 2: a directory that was removed but is still held (a process's working directory, an open port) accepts new names. The file entered is reachable from nowhere, and once the directory goes, e2fsck reports it as an unattached inode: $ mkdir /tmp/d && cd /tmp/d && rmdir /tmp/d && touch x; echo $? 0 With the patch the create fails with ENOENT, as on Linux. A rename into such a directory is refused too, before ".." is rewritten. Patch 3: on a filesystem mounted with -s, a create that fails (no space, no free inode) called diskfs_file_update with a null node and killed the translator. Thanks, Milos Milos Nikic (3): libdiskfs: Do not unlock the directory being moved before locking it libdiskfs: Do not enter names in a removed directory libdiskfs: Do not update a node that a failed create did not make libdiskfs/dir-lookup.c | 4 +++- libdiskfs/dir-renamed.c | 14 +++++++++++++- libdiskfs/direnter.c | 9 +++++++++ 3 files changed, 25 insertions(+), 2 deletions(-) -- 2.56.0
