[PATCH RFC 01/28] ecryptfs: don't leak the inode when a lookup can't open the lower file

[Christian Brauner]

ecryptfs_lookup_interpose() opens the lower file of a regular file to
read the size from the header. If that fails it calls make_bad_inode()
and returns the error. A new inode is still I_NEW at that point and
nothing ever unlocks or puts it, so it leaks together with the reference
it holds on the lower inode. And an inode that was already in the cache
gets marked bad for all its other users instead of just losing the
reference this lookup took.

umount then complains:

  VFS: Busy inodes after unmount of ecryptfs (ecryptfs)

That's a WARN, or a BUG with CONFIG_BUG_ON_DATA_CORRUPTION. The lower
filesystem reports the same when it is unmounted. Use iget_failed() for
a new inode and iput() for one from the cache.

Reproducer, opening the lower file read-write fails on a read-only bind
mount:

  sig=$(printf x | ecryptfs-add-passphrase - | sed -n 's/.*\[\(.*\)\].*/\1/p')
  mount --bind -o ro /lower /lower
  mount -i -t ecryptfs -o ecryptfs_sig=$sig,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_passthrough /lower /upper
  cat /upper/f      # EROFS
  umount /upper     # VFS: Busy inodes after unmount of ecryptfs

Fixes: 3b06b3ebf441 ("eCryptfs: Fix new inode race condition")
Cc: stable at vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner at kernel.org>
---
 fs/ecryptfs/inode.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 525297c7ebd8..0d8452558a98 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -362,7 +362,10 @@ static struct dentry *ecryptfs_lookup_interpose(struct dentry *dentry,
 	if (S_ISREG(inode->i_mode)) {
 		rc = ecryptfs_i_size_read(dentry, inode);
 		if (rc) {
-			make_bad_inode(inode);
+			if (inode_state_read_once(inode) & I_NEW)
+				iget_failed(inode);
+			else
+				iput(inode);
 			return ERR_PTR(rc);
 		}
 	}

-- 
2.53.0