do d_instantiate/unlock_new_inode combinations safely
commit 1e2e547a93 upstream.
For anything NFS-exported we do _not_ want to unlock new inode
before it has grown an alias; original set of fixes got the
ordering right, but missed the nasty complication in case of
lockdep being enabled - unlock_new_inode() does
lockdep_annotate_inode_mutex_key(inode)
which can only be done before anyone gets a chance to touch
->i_mutex. Unfortunately, flipping the order and doing
unlock_new_inode() before d_instantiate() opens a window when
mkdir can race with open-by-fhandle on a guessed fhandle, leading
to multiple aliases for a directory inode and all the breakage
that follows from that.
Correct solution: a new primitive (d_instantiate_new())
combining these two in the right order - lockdep annotate, then
d_instantiate(), then the rest of unlock_new_inode(). All
combinations of d_instantiate() with unlock_new_inode() should
be converted to that.
Cc: stable@kernel.org # 2.6.29 and later
Tested-by: Mike Marshall <hubcap@omnibond.com>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
pull/10/head
Al Viro
Greg Kroah-Hartman
parent
ba3fbb7afd
commit
f440ea85d4
|
|
@ -6664,8 +6664,7 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
|
|||
goto out_unlock_inode;
|
||||
} else {
|
||||
btrfs_update_inode(trans, root, inode);
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
}
|
||||
|
||||
out_unlock:
|
||||
|
|
@ -6742,8 +6741,7 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
|
|||
goto out_unlock_inode;
|
||||
|
||||
BTRFS_I(inode)->io_tree.ops = &btrfs_extent_io_ops;
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
|
||||
out_unlock:
|
||||
btrfs_end_transaction(trans);
|
||||
|
|
@ -6890,12 +6888,7 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
|
|||
if (err)
|
||||
goto out_fail_inode;
|
||||
|
||||
d_instantiate(dentry, inode);
|
||||
/*
|
||||
* mkdir is special. We're unlocking after we call d_instantiate
|
||||
* to avoid a race with nfsd calling d_instantiate.
|
||||
*/
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
drop_on_err = 0;
|
||||
|
||||
out_fail:
|
||||
|
|
@ -10573,8 +10566,7 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
|
|||
goto out_unlock_inode;
|
||||
}
|
||||
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
|
||||
out_unlock:
|
||||
btrfs_end_transaction(trans);
|
||||
|
|
|
|||
22
fs/dcache.c
22
fs/dcache.c
|
|
@ -1867,6 +1867,28 @@ void d_instantiate(struct dentry *entry, struct inode * inode)
|
|||
}
|
||||
EXPORT_SYMBOL(d_instantiate);
|
||||
|
||||
/*
|
||||
* This should be equivalent to d_instantiate() + unlock_new_inode(),
|
||||
* with lockdep-related part of unlock_new_inode() done before
|
||||
* anything else. Use that instead of open-coding d_instantiate()/
|
||||
* unlock_new_inode() combinations.
|
||||
*/
|
||||
void d_instantiate_new(struct dentry *entry, struct inode *inode)
|
||||
{
|
||||
BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
|
||||
BUG_ON(!inode);
|
||||
lockdep_annotate_inode_mutex_key(inode);
|
||||
security_d_instantiate(entry, inode);
|
||||
spin_lock(&inode->i_lock);
|
||||
__d_instantiate(entry, inode);
|
||||
WARN_ON(!(inode->i_state & I_NEW));
|
||||
inode->i_state &= ~I_NEW;
|
||||
smp_mb();
|
||||
wake_up_bit(&inode->i_state, __I_NEW);
|
||||
spin_unlock(&inode->i_lock);
|
||||
}
|
||||
EXPORT_SYMBOL(d_instantiate_new);
|
||||
|
||||
/**
|
||||
* d_instantiate_no_diralias - instantiate a non-aliased dentry
|
||||
* @entry: dentry to complete
|
||||
|
|
|
|||
|
|
@ -284,8 +284,7 @@ ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry,
|
|||
iget_failed(ecryptfs_inode);
|
||||
goto out;
|
||||
}
|
||||
unlock_new_inode(ecryptfs_inode);
|
||||
d_instantiate(ecryptfs_dentry, ecryptfs_inode);
|
||||
d_instantiate_new(ecryptfs_dentry, ecryptfs_inode);
|
||||
out:
|
||||
return rc;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -41,8 +41,7 @@ static inline int ext2_add_nondir(struct dentry *dentry, struct inode *inode)
|
|||
{
|
||||
int err = ext2_add_link(dentry, inode);
|
||||
if (!err) {
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
return 0;
|
||||
}
|
||||
inode_dec_link_count(inode);
|
||||
|
|
@ -269,8 +268,7 @@ static int ext2_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode)
|
|||
if (err)
|
||||
goto out_fail;
|
||||
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
out:
|
||||
return err;
|
||||
|
||||
|
|
|
|||
|
|
@ -2420,8 +2420,7 @@ static int ext4_add_nondir(handle_t *handle,
|
|||
int err = ext4_add_entry(handle, dentry, inode);
|
||||
if (!err) {
|
||||
ext4_mark_inode_dirty(handle, inode);
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
return 0;
|
||||
}
|
||||
drop_nlink(inode);
|
||||
|
|
@ -2660,8 +2659,7 @@ out_clear_inode:
|
|||
err = ext4_mark_inode_dirty(handle, dir);
|
||||
if (err)
|
||||
goto out_clear_inode;
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
if (IS_DIRSYNC(dir))
|
||||
ext4_handle_sync(handle);
|
||||
|
||||
|
|
|
|||
|
|
@ -201,8 +201,7 @@ static int f2fs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
|
|||
|
||||
alloc_nid_done(sbi, ino);
|
||||
|
||||
d_instantiate(dentry, inode);
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
|
||||
if (IS_DIRSYNC(dir))
|
||||
f2fs_sync_fs(sbi->sb, 1);
|
||||
|
|
@ -529,8 +528,7 @@ static int f2fs_symlink(struct inode *dir, struct dentry *dentry,
|
|||
err = page_symlink(inode, disk_link.name, disk_link.len);
|
||||
|
||||
err_out:
|
||||
d_instantiate(dentry, inode);
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
|
||||
/*
|
||||
* Let's flush symlink data in order to avoid broken symlink as much as
|
||||
|
|
@ -588,8 +586,7 @@ static int f2fs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
|
|||
|
||||
alloc_nid_done(sbi, inode->i_ino);
|
||||
|
||||
d_instantiate(dentry, inode);
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
|
||||
if (IS_DIRSYNC(dir))
|
||||
f2fs_sync_fs(sbi->sb, 1);
|
||||
|
|
@ -637,8 +634,7 @@ static int f2fs_mknod(struct inode *dir, struct dentry *dentry,
|
|||
|
||||
alloc_nid_done(sbi, inode->i_ino);
|
||||
|
||||
d_instantiate(dentry, inode);
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
|
||||
if (IS_DIRSYNC(dir))
|
||||
f2fs_sync_fs(sbi->sb, 1);
|
||||
|
|
|
|||
|
|
@ -209,8 +209,7 @@ static int jffs2_create(struct inode *dir_i, struct dentry *dentry,
|
|||
__func__, inode->i_ino, inode->i_mode, inode->i_nlink,
|
||||
f->inocache->pino_nlink, inode->i_mapping->nrpages);
|
||||
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
return 0;
|
||||
|
||||
fail:
|
||||
|
|
@ -430,8 +429,7 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
|
|||
mutex_unlock(&dir_f->sem);
|
||||
jffs2_complete_reservation(c);
|
||||
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
return 0;
|
||||
|
||||
fail:
|
||||
|
|
@ -575,8 +573,7 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, umode_t mode
|
|||
mutex_unlock(&dir_f->sem);
|
||||
jffs2_complete_reservation(c);
|
||||
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
return 0;
|
||||
|
||||
fail:
|
||||
|
|
@ -747,8 +744,7 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, umode_t mode
|
|||
mutex_unlock(&dir_f->sem);
|
||||
jffs2_complete_reservation(c);
|
||||
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
return 0;
|
||||
|
||||
fail:
|
||||
|
|
|
|||
|
|
@ -178,8 +178,7 @@ static int jfs_create(struct inode *dip, struct dentry *dentry, umode_t mode,
|
|||
unlock_new_inode(ip);
|
||||
iput(ip);
|
||||
} else {
|
||||
unlock_new_inode(ip);
|
||||
d_instantiate(dentry, ip);
|
||||
d_instantiate_new(dentry, ip);
|
||||
}
|
||||
|
||||
out2:
|
||||
|
|
@ -313,8 +312,7 @@ static int jfs_mkdir(struct inode *dip, struct dentry *dentry, umode_t mode)
|
|||
unlock_new_inode(ip);
|
||||
iput(ip);
|
||||
} else {
|
||||
unlock_new_inode(ip);
|
||||
d_instantiate(dentry, ip);
|
||||
d_instantiate_new(dentry, ip);
|
||||
}
|
||||
|
||||
out2:
|
||||
|
|
@ -1059,8 +1057,7 @@ static int jfs_symlink(struct inode *dip, struct dentry *dentry,
|
|||
unlock_new_inode(ip);
|
||||
iput(ip);
|
||||
} else {
|
||||
unlock_new_inode(ip);
|
||||
d_instantiate(dentry, ip);
|
||||
d_instantiate_new(dentry, ip);
|
||||
}
|
||||
|
||||
out2:
|
||||
|
|
@ -1447,8 +1444,7 @@ static int jfs_mknod(struct inode *dir, struct dentry *dentry,
|
|||
unlock_new_inode(ip);
|
||||
iput(ip);
|
||||
} else {
|
||||
unlock_new_inode(ip);
|
||||
d_instantiate(dentry, ip);
|
||||
d_instantiate_new(dentry, ip);
|
||||
}
|
||||
|
||||
out1:
|
||||
|
|
|
|||
|
|
@ -46,8 +46,7 @@ static inline int nilfs_add_nondir(struct dentry *dentry, struct inode *inode)
|
|||
int err = nilfs_add_link(dentry, inode);
|
||||
|
||||
if (!err) {
|
||||
d_instantiate(dentry, inode);
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
return 0;
|
||||
}
|
||||
inode_dec_link_count(inode);
|
||||
|
|
@ -243,8 +242,7 @@ static int nilfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
|
|||
goto out_fail;
|
||||
|
||||
nilfs_mark_inode_dirty(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
out:
|
||||
if (!err)
|
||||
err = nilfs_transaction_commit(dir->i_sb);
|
||||
|
|
|
|||
|
|
@ -71,8 +71,7 @@ static int orangefs_create(struct inode *dir,
|
|||
get_khandle_from_ino(inode),
|
||||
dentry);
|
||||
|
||||
d_instantiate(dentry, inode);
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
orangefs_set_timeout(dentry);
|
||||
ORANGEFS_I(inode)->getattr_time = jiffies - 1;
|
||||
ORANGEFS_I(inode)->getattr_mask = STATX_BASIC_STATS;
|
||||
|
|
@ -320,8 +319,7 @@ static int orangefs_symlink(struct inode *dir,
|
|||
"Assigned symlink inode new number of %pU\n",
|
||||
get_khandle_from_ino(inode));
|
||||
|
||||
d_instantiate(dentry, inode);
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
orangefs_set_timeout(dentry);
|
||||
ORANGEFS_I(inode)->getattr_time = jiffies - 1;
|
||||
ORANGEFS_I(inode)->getattr_mask = STATX_BASIC_STATS;
|
||||
|
|
@ -385,8 +383,7 @@ static int orangefs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
|
|||
"Assigned dir inode new number of %pU\n",
|
||||
get_khandle_from_ino(inode));
|
||||
|
||||
d_instantiate(dentry, inode);
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
orangefs_set_timeout(dentry);
|
||||
ORANGEFS_I(inode)->getattr_time = jiffies - 1;
|
||||
ORANGEFS_I(inode)->getattr_mask = STATX_BASIC_STATS;
|
||||
|
|
|
|||
|
|
@ -687,8 +687,7 @@ static int reiserfs_create(struct inode *dir, struct dentry *dentry, umode_t mod
|
|||
reiserfs_update_inode_transaction(inode);
|
||||
reiserfs_update_inode_transaction(dir);
|
||||
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
retval = journal_end(&th);
|
||||
|
||||
out_failed:
|
||||
|
|
@ -771,8 +770,7 @@ static int reiserfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode
|
|||
goto out_failed;
|
||||
}
|
||||
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
retval = journal_end(&th);
|
||||
|
||||
out_failed:
|
||||
|
|
@ -871,8 +869,7 @@ static int reiserfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
|
|||
/* the above add_entry did not update dir's stat data */
|
||||
reiserfs_update_sd(&th, dir);
|
||||
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
retval = journal_end(&th);
|
||||
out_failed:
|
||||
reiserfs_write_unlock(dir->i_sb);
|
||||
|
|
@ -1187,8 +1184,7 @@ static int reiserfs_symlink(struct inode *parent_dir,
|
|||
goto out_failed;
|
||||
}
|
||||
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
retval = journal_end(&th);
|
||||
out_failed:
|
||||
reiserfs_write_unlock(parent_dir->i_sb);
|
||||
|
|
|
|||
|
|
@ -621,8 +621,7 @@ static int udf_add_nondir(struct dentry *dentry, struct inode *inode)
|
|||
if (fibh.sbh != fibh.ebh)
|
||||
brelse(fibh.ebh);
|
||||
brelse(fibh.sbh);
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -732,8 +731,7 @@ static int udf_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
|
|||
inc_nlink(dir);
|
||||
dir->i_ctime = dir->i_mtime = current_time(dir);
|
||||
mark_inode_dirty(dir);
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
if (fibh.sbh != fibh.ebh)
|
||||
brelse(fibh.ebh);
|
||||
brelse(fibh.sbh);
|
||||
|
|
|
|||
|
|
@ -39,8 +39,7 @@ static inline int ufs_add_nondir(struct dentry *dentry, struct inode *inode)
|
|||
{
|
||||
int err = ufs_add_link(dentry, inode);
|
||||
if (!err) {
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
return 0;
|
||||
}
|
||||
inode_dec_link_count(inode);
|
||||
|
|
@ -193,8 +192,7 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode)
|
|||
if (err)
|
||||
goto out_fail;
|
||||
|
||||
unlock_new_inode(inode);
|
||||
d_instantiate(dentry, inode);
|
||||
d_instantiate_new(dentry, inode);
|
||||
return 0;
|
||||
|
||||
out_fail:
|
||||
|
|
|
|||
|
|
@ -226,6 +226,7 @@ extern seqlock_t rename_lock;
|
|||
* These are the low-level FS interfaces to the dcache..
|
||||
*/
|
||||
extern void d_instantiate(struct dentry *, struct inode *);
|
||||
extern void d_instantiate_new(struct dentry *, struct inode *);
|
||||
extern struct dentry * d_instantiate_unique(struct dentry *, struct inode *);
|
||||
extern int d_instantiate_no_diralias(struct dentry *, struct inode *);
|
||||
extern void __d_drop(struct dentry *dentry);
|
||||
|
|
|
|||
Loading…
Reference in New Issue