Re: Races in affs_unlink(), affs_rmdir() and affs_rename()

Hi, Alexander Viro wrote: > unlink("/B/b") locks /B, removes "b" and unlocks /B. Then it calls > affs_remove_link(), which blocks. > > unlink("/A/a") locks /A, removes "a" and unlocks /A. Then it calls > affs_remove_link(). Which locks /B, renames removed entry into "b", > removes old "b" and i

Races in affs_unlink(), affs_rmdir() and affs_rename()

mkdir /A mkdir /B mkdir /C touch /A/a ln /A/a /B/b ln /A/a /C/c rm /A/a & rm /B/b can corrupt filesystem. Scenario: unlink("/B/b") locks /B, removes "b" and unlocks /B. Then it calls affs_remove_link(), which blocks. unlink("/A/a") locks /A, removes "a" and unlocks /A. Then it calls affs_remove