udf: fix the udf_iget() vs. udf_new_inode() races
Currently udf_iget() (triggered by NFS) can race with udf_new_inode() leading to two inode structures with the same inode number: nfsd: iget_locked() creates inode nfsd: try to read from disk, block on that. udf_new_inode(): allocate inode with that inumber udf_new_inode(): insert it into icache, set it up and dirty udf_write_inode(): write inode into buffer cache nfsd: get CPU again, look into buffer cache, see nice and sane on-disk inode, set the in-core inode from it Fix the problem by putting inode into icache in locked state (I_NEW set) and unlocking it only after it's fully set up. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jan Kara <jack@suse.cz>
This commit is contained in:
parent
d2be51cb34
commit
b231509616
|
@ -124,7 +124,12 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode, int *err)
|
|||
iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
|
||||
inode->i_mtime = inode->i_atime = inode->i_ctime =
|
||||
iinfo->i_crtime = current_fs_time(inode->i_sb);
|
||||
insert_inode_hash(inode);
|
||||
if (unlikely(insert_inode_locked(inode) < 0)) {
|
||||
make_bad_inode(inode);
|
||||
iput(inode);
|
||||
*err = -EIO;
|
||||
return NULL;
|
||||
}
|
||||
mark_inode_dirty(inode);
|
||||
|
||||
*err = 0;
|
||||
|
|
|
@ -559,6 +559,7 @@ static int udf_add_nondir(struct dentry *dentry, struct inode *inode)
|
|||
fi = udf_add_entry(dir, dentry, &fibh, &cfi, &err);
|
||||
if (unlikely(!fi)) {
|
||||
inode_dec_link_count(inode);
|
||||
unlock_new_inode(inode);
|
||||
iput(inode);
|
||||
return err;
|
||||
}
|
||||
|
@ -572,6 +573,7 @@ static int udf_add_nondir(struct dentry *dentry, struct inode *inode)
|
|||
if (fibh.sbh != fibh.ebh)
|
||||
brelse(fibh.ebh);
|
||||
brelse(fibh.sbh);
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
|
||||
return 0;
|
||||
|
@ -619,6 +621,7 @@ static int udf_tmpfile(struct inode *dir, struct dentry *dentry, umode_t mode)
|
|||
mark_inode_dirty(inode);
|
||||
|
||||
d_tmpfile(dentry, inode);
|
||||
unlock_new_inode(inode);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
@ -660,6 +663,7 @@ static int udf_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
|
|||
fi = udf_add_entry(inode, NULL, &fibh, &cfi, &err);
|
||||
if (!fi) {
|
||||
inode_dec_link_count(inode);
|
||||
unlock_new_inode(inode);
|
||||
iput(inode);
|
||||
goto out;
|
||||
}
|
||||
|
@ -678,6 +682,7 @@ static int udf_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
|
|||
if (!fi) {
|
||||
clear_nlink(inode);
|
||||
mark_inode_dirty(inode);
|
||||
unlock_new_inode(inode);
|
||||
iput(inode);
|
||||
goto out;
|
||||
}
|
||||
|
@ -689,6 +694,7 @@ static int udf_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
|
|||
udf_write_fi(dir, &cfi, fi, &fibh, NULL, NULL);
|
||||
inc_nlink(dir);
|
||||
mark_inode_dirty(dir);
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
if (fibh.sbh != fibh.ebh)
|
||||
brelse(fibh.ebh);
|
||||
|
@ -996,6 +1002,7 @@ out:
|
|||
out_no_entry:
|
||||
up_write(&iinfo->i_data_sem);
|
||||
inode_dec_link_count(inode);
|
||||
unlock_new_inode(inode);
|
||||
iput(inode);
|
||||
goto out;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue