Patch "vfs: fix deadlock in file_remove_privs() on overlayfs" has been added to the 4.6-stable tree

This is a note to let you know that I've just added the patch titled

vfs: fix deadlock in file_remove_privs() on overlayfs

to the 4.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
vfs-fix-deadlock-in-file_remove_privs-on-overlayfs.patch
and it can be found in the queue-4.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Miklos Szeredi <[email protected]>
Date: Wed, 3 Aug 2016 13:44:27 +0200
Subject: vfs: fix deadlock in file_remove_privs() on overlayfs

From: Miklos Szeredi <[email protected]>

commit c1892c37769cf89c7e7ba57528ae2ccb5d153c9b upstream.

file_remove_privs() is called with inode lock on file_inode(), which proceeds to calling notify_change() on file->f_path.dentry. Which triggers the WARN_ON_ONCE(!inode_is_locked(inode)) in addition to deadlocking later when ovl_setattr tries to lock the underlying inode again.

Fix this mess by not mixing the layers, but doing everything on underlying dentry/inode.

---
 fs/inode.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -1739,8 +1739,8 @@ static int __remove_privs(struct dentry
  */
 int file_remove_privs(struct file *file)
 {
-	struct dentry *dentry = file->f_path.dentry;
-	struct inode *inode = d_inode(dentry);
+	struct dentry *dentry = file_dentry(file);
+	struct inode *inode = file_inode(file);
 	int kill;
 	int error = 0;
 

@@ -1748,7 +1748,7 @@ int file_remove_privs(struct file *file)
 	if (IS_NOSEC(inode))
 		return 0;
 
-	kill = file_needs_remove_privs(file);
+	kill = dentry_needs_remove_privs(dentry);
 	if (kill < 0)
 		return kill;
 	if (kill)

Patches currently in stable-queue which might be from [email protected] are

queue-4.6/vfs-fix-deadlock-in-file_remove_privs-on-overlayfs.patch queue-4.6/9p-use-file_dentry.patch queue-4.6/locks-use-file_inode.patch