Revert "namei: don't reveal overmounted entries in refwalk"

This reverts commit 8189ab688f.

This bug class is bigger than can be fixed with this simple patch.
Back out of it and give us some time to fix this properly.

Signed-off-by: Christian Brauner <[email protected]>
This commit is contained in:
Christian Brauner committed 2026-10-16 10:50:57 +02:00
1 parent 906f04fb1e
commit 214897acc8
1 file changed
-29
-29
View File
@@ -2086,33 +2086,6 @@ all_done: // pure jump
return NULL;
}
/*
* Be careful in case the dentry is unlinked or renamed. Any mounts
* stacked on top of it are going away. We need to make sure that we
* don't reveal the underyling dentry during refwalk. In rcuwalk we
* catch this via d_seq and another lookup for the name. Give the same
* guarantee in refwalk.
*/
static bool unlink_may_reveal(struct nameidata *nd, int flags,
struct path *path, struct dentry *dentry)
{
/* ".." and LOOKUP_DOWN may land on an unhashed directory */
if (flags & WALK_NOFOLLOW)
return false;
if (nd->flags & LOOKUP_REVAL)
return false;
/* We crossed onto a mount and the name led us here while it still existed */
if (path->mnt != nd->path.mnt)
return false;
/* only a name on its way out is flagged */
if (likely(!cant_mount(dentry)))
return false;
if (!d_unlinked(dentry))
return false;
dput(no_free_ptr(path->dentry));
return true;
}
/*
* Do we need to follow links? We _really_ want to be able
* to do this check without having to look at inode->i_op,
@@ -2142,8 +2115,6 @@ static noinline const char *step_into_slowpath(struct nameidata *nd, int flags,
if (unlikely(!inode))
return ERR_PTR(-ENOENT);
} else {
if (unlikely(unlink_may_reveal(nd, flags, &path, dentry)))
return ERR_PTR(-ESTALE);
dput(nd->path.dentry);
if (nd->path.mnt != path.mnt)
mntput(nd->path.mnt);