From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f53.google.com (mail-dl1-f53.google.com [74.125.82.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 68B06357CF4 for ; Fri, 2 Oct 2026 19:48:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790970499; cv=none; b=T6A8oDCG6o+BxlXonpws6A8FhKZ2xHaFqhoNo40cjyWWYyqOuxmFVET13Bxwlw8JMHZ4w1DooLumtHjwqSaEqMhqjK+RnLBLgAUsGHAZ5KKgDRYUT+G2gV70ohfj+9Tp6R5HwvejmvDGj94wQVeASIX50ptqh2T/2QTqXD2hdnw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790970499; c=relaxed/simple; bh=kp3aRPj0yrJneSRrwqt3a3WCuPfKKaOvNaPQ5Y5IZvs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=uXkCtJ64qZE6ikz4KIraYF1TTdZxulBhJWRn3peNTQ9WANiLg0umPaHMUgUfQLXjX0nvDbYXQOZc8UTL5nXZMNyV3WcqmQ3X0XedNelL9laHQqKyIO+MYYzLWPPbGvhceKfarowx3iVuURgC30i5pmxPpNSDSNAraBIWojGKAbI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=ielnhv70; arc=none smtp.client-ip=74.125.82.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="ielnhv70" Received: by mail-dl1-f53.google.com with SMTP id a92af1059eb24-149241d04f5so312543c88.0 for ; Fri, 02 Oct 2026 12:48:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1790970493; x=1791575293; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=ZPRt5eKpQYZLRacEDFzRrkBIy6qGtNsmMHZIyJ1pN3M=; b=ielnhv70tVjzEww7gu5b20HMwHDwve7GJvTmo4fvmE2TE/d+9MgNulyrgrGLAVu7MF 3qjCsZ7cKf1HFkis0ZsdLDASm7ojh7Wk9/JpxvyYpFtIYTP3hh39vWZlkbkpJv0Io4xo wy7iViem24RCN4OhuV4TzwGnmXR0JT9/0aPbAZfK1yoce2/HNQTUSdBbA3RUhFdtnOqj XxfZ3m0rWup+v5F+5rruH9s056DjW7TeSMCeT4yYOsoYj2+5yOFvdBWCecmxvNNjVqKt gACz9hKSFHX4rJT2zudE6TG3IpRnMn34/QfSXoYpGbwuzVk7mIiwModud6jhdHR+8c59 QmuQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790970493; x=1791575293; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ZPRt5eKpQYZLRacEDFzRrkBIy6qGtNsmMHZIyJ1pN3M=; b=y8DFaAm3OEMSsMoVZOZfn5a8j4k7O80Bh8KTtTOim+ecKWNAHQKLKz43cm4S0dxLZl bCy1Mgf94MFGK2SB66MeWPPa4aTwFo/pxISVCEMW2vZtGQp51C8mhDFzgseNvqox0OpD fzg/WfAk2rbOGbA7d2N8xUNjzjme9HKrWjtHmroq13YnMWEoSqz0oKS87JjU76tbTOk/ +zAVKUx3fXW7rp006MJF5vo7HN2VzCrqZ7V5r63/XZ1z7/sqxfuC4Re0XU1YXWXBmTDs w0SM5+9E1QONZtZmGXREf43zyI2cIWQLPdCcdceatAq/xLWIFa+wmWmuFIvlJzCv2QCs LfFw== X-Forwarded-Encrypted: i=1; AKwUvByBzPxFwWsfUYqf+lAWkJvSVZjpsoeIWhgLTN1hu1NdWCKDRQ1eVXXIZwv+bT71igyjgbKK56gVLMUdZKc=@vger.kernel.org X-Gm-Message-State: AFuF++lCZIA9Ib3vT6c2WIcFX9RjRZLuDRupm6T8f9R83dGRi0InugRy lbQH82m0uI8kBt2Ikq8nxMqfEuxZApXwZ9N+oAeNJjiSVOs3PQlRy+QXZ4/qmBLPE45kmGC9PjD 5FviHoVDZ6A== X-Gm-Gg: AYBFou35uCnKGQ3dnHMHaFY+7OqjKRoALAogD3Q1jCrhyBMxGkkw/XJYLja5iDJSqRA 6J9CtZZIr/qVC7+QXLrvtQDWaNwbdBt20mCa4qZNqPn5KrYxZREsRY2CxPZzTkbGeBd7Bn8RkZX Wa3WNEA1898bjqBAlQ3GuB10eQeV6ArS5TK14WIuRwZN7ptwowwql2RvZzjE2P7f3We6eD4IaF+ Ojxpa9bMM0aRuMo+VaTtsXltixZq0WY8gzczqQabkxmgvs7nUZSVeY5kJFshSlGK1+1O2RziEcV l7hl1ZpphqcpjXsGgvJxSYv5QKHzm9wyojRrSc5wbzrze3RgvTsRJ7fE9lrvQd2c8eeD9zV6bbm bk16LWoH7u1Ed1p5jI2Hzldtp8L49FD44oPV4b9scLP+cxb2jsulBx1UI36a7WNdsGYBlP8bOVo q4RVZ3gzVCh16pCY9YDXwDYxeshoqbKzw5UmAn9C9+epZ0J27MNWF2juhAGs+ideUKgaUAOszSS w2zubNGVIAv01LNMDrKy46qlh2qM8D2sfQbCDiK9bd0G1f2ujOBa/1baEgf8Insz7u+tHQO X-Received: by 2002:a05:701b:221c:b0:14a:8cff:fbb8 with SMTP id a92af1059eb24-151c38b1453mr554659c88.28.1790970492218; Fri, 02 Oct 2026 12:48:12 -0700 (PDT) Received: from localhost.localdomain ([2603:8001:5f01:8bab:bcf9:6140:24a9:d1e7]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-34f14f97a5fsm12698196eec.15.2026.10.02.12.48.11 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 02 Oct 2026 12:48:11 -0700 (PDT) From: Artem Dinaburg To: stable@vger.kernel.org Cc: Artem Dinaburg , Greg Kroah-Hartman , Sasha Levin , Jan Kara , Al Viro , Mark Fasheh , Joel Becker , Joseph Qi , ocfs2-devel@lists.linux.dev, linux-kernel@vger.kernel.org, Heming Zhao Subject: [PATCH 6.1.y] ocfs2: Avoid touching renamed directory if parent does not change Date: Fri, 2 Oct 2026 15:48:06 -0400 Message-ID: <20261002194807.21118-1-artem@trailofbits.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Jan Kara [ Upstream commit 9d618d19b29c2943527e3a43da0a35aea91062fc ] The VFS will not be locking moved directory if its parent does not change. Change ocfs2 rename code to avoid touching renamed directory if its parent does not change as without locking that can corrupt the filesystem. Signed-off-by: Jan Kara Signed-off-by: Al Viro Assisted-by: LLM Signed-off-by: Artem Dinaburg --- Hi Greg, Sasha, and fs ocfs2 maintainers, I am working through the small CVE backports still missing from 6.1.y. This one addresses CVE-2023-52590. It avoids updating a renamed directory without the VFS lock when its parent is unchanged. The corresponding 6.6.y backport is already in the 6.6.y stable queue. The fix is already present in 6.12.y, 6.18.y, and 7.2.y, but not in 6.1.y. The code change is identical to upstream. Could you please queue it for 6.1.y? CVE: CVE-2023-52590 Upstream: 9d618d19b29c2943527e3a43da0a35aea91062fc AI assistance: An LLM helped identify, adapt, and validate this backport; I reviewed the resulting code and validation evidence. Thanks, Artem Dinaburg fs/ocfs2/namei.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c index c97c6fdb8cec23..a4804694cf1fd5 100644 --- a/fs/ocfs2/namei.c +++ b/fs/ocfs2/namei.c @@ -1345,7 +1345,7 @@ static int ocfs2_rename(struct user_namespace *mnt_userns, goto bail; } - if (S_ISDIR(old_inode->i_mode)) { + if (S_ISDIR(old_inode->i_mode) && new_dir != old_dir) { u64 old_inode_parent; update_dot_dot = 1; @@ -1362,8 +1362,7 @@ static int ocfs2_rename(struct user_namespace *mnt_userns, goto bail; } - if (!new_inode && new_dir != old_dir && - new_dir->i_nlink >= ocfs2_link_max(osb)) { + if (!new_inode && new_dir->i_nlink >= ocfs2_link_max(osb)) { status = -EMLINK; goto bail; } @@ -1606,6 +1605,9 @@ static int ocfs2_rename(struct user_namespace *mnt_userns, if (update_dot_dot) { status = ocfs2_update_entry(old_inode, handle, &old_inode_dot_dot_res, new_dir); + } + + if (S_ISDIR(old_inode->i_mode)) { drop_nlink(old_dir); if (new_inode) { drop_nlink(new_inode); -- 2.39.5