ANDROID: sdcardfs: Change current->fs under lock

bug: 111641492

Change-Id: I79e9894f94880048edaf0f7cfa2d180f65cbcf3b
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Signed-off-by: Paul Keith <javelinanddart@gmail.com>

diff --git a/fs/sdcardfs/inode.c b/fs/sdcardfs/inode.c
index 93cc7e508ac369103277ef90cda1480a9b8c282a..a3acabc27bd7fb7b866b825169013dbdd9796af8 100644 (file)
--- a/fs/sdcardfs/inode.c
+++ b/fs/sdcardfs/inode.c
@@ -96,8 +96,11 @@ static int sdcardfs_create(struct inode *dir, struct dentry *dentry,
                err = -ENOMEM;
                goto out_unlock;
        }
+       copied_fs->umask = 0;
+       task_lock(current);
        current->fs = copied_fs;
-       current->fs->umask = 0;
+       task_unlock(current);
+
        err = vfs_create2(lower_dentry_mnt, lower_parent_dentry->d_inode, lower_dentry, mode, want_excl);
        if (err)
                goto out;
@@ -111,7 +114,9 @@ static int sdcardfs_create(struct inode *dir, struct dentry *dentry,
        fixup_lower_ownership(dentry, dentry->d_name.name);
 
 out:
+       task_lock(current);
        current->fs = saved_fs;
+       task_unlock(current);
        free_fs_struct(copied_fs);
 out_unlock:
        unlock_dir(lower_parent_dentry);
@@ -249,8 +254,10 @@ static int sdcardfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
                unlock_dir(lower_parent_dentry);
                goto out_unlock;
        }
+       copied_fs->umask = 0;
+       task_lock(current);
        current->fs = copied_fs;
-       current->fs->umask = 0;
+       task_unlock(current);
        err = vfs_mkdir2(lower_mnt, lower_parent_dentry->d_inode, lower_dentry, mode);
 
        if (err) {
@@ -318,7 +325,10 @@ static int sdcardfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
                }
        }
 out:
+       task_lock(current);
        current->fs = saved_fs;
+       task_unlock(current);
+
        free_fs_struct(copied_fs);
 out_unlock:
        sdcardfs_put_lower_path(dentry, &lower_path);