Patch "ubifs: Fix O_TMPFILE corner case in ubifs_link()" has been added to the 4.10-stable tree

This is a note to let you know that I've just added the patch titled

ubifs: Fix O_TMPFILE corner case in ubifs_link()

to the 4.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ubifs-fix-o_tmpfile-corner-case-in-ubifs_link.patch
and it can be found in the queue-4.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Richard Weinberger <[email protected]>
Date: Thu, 30 Mar 2017 10:50:49 +0200
Subject: ubifs: Fix O_TMPFILE corner case in ubifs_link()

From: Richard Weinberger <[email protected]>

commit 32fe905c17f001c0eee13c59afddd0bf2eed509c upstream.

It is perfectly fine to link a tmpfile back using linkat(). Since tmpfiles are created with a link count of 0 they appear on the orphan list, upon re-linking the inode has to be removed from the orphan list again.

Ralph faced a filesystem corruption in combination with overlayfs due to this bug.

---
 fs/ubifs/dir.c |    7 +++++++
 1 file changed, 7 insertions(+)

@@ -748,6 +748,11 @@ static int ubifs_link(struct dentry *old
 		goto out_fname;
 
 	lock_2_inodes(dir, inode);
+
+	/* Handle O_TMPFILE corner case, it is allowed to link a O_TMPFILE. */
+	if (inode->i_nlink == 0)
+		ubifs_delete_orphan(c, inode->i_ino);
+
 	inc_nlink(inode);
 	ihold(inode);
 	inode->i_ctime = ubifs_current_time(inode);

@@ -768,6 +773,8 @@ out_cancel:
 	dir->i_size -= sz_change;
 	dir_ui->ui_size = dir->i_size;
 	drop_nlink(inode);
+	if (inode->i_nlink == 0)
+		ubifs_add_orphan(c, inode->i_ino);
 	unlock_2_inodes(dir, inode);
 	ubifs_release_budget(c, &req);
 	iput(inode);

Patches currently in stable-queue which might be from [email protected] are

queue-4.10/ubifs-fix-rename_whiteout-support.patch queue-4.10/ubi-upd-always-flush-after-prepared-for-an-update.patch queue-4.10/ubifs-fix-o_tmpfile-corner-case-in-ubifs_link.patch