Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1e2e547a authored by Al Viro's avatar Al Viro
Browse files

do d_instantiate/unlock_new_inode combinations safely 



For anything NFS-exported we do _not_ want to unlock new inode
before it has grown an alias; original set of fixes got the
ordering right, but missed the nasty complication in case of
lockdep being enabled - unlock_new_inode() does
	lockdep_annotate_inode_mutex_key(inode)
which can only be done before anyone gets a chance to touch
->i_mutex.  Unfortunately, flipping the order and doing
unlock_new_inode() before d_instantiate() opens a window when
mkdir can race with open-by-fhandle on a guessed fhandle, leading
to multiple aliases for a directory inode and all the breakage
that follows from that.

	Correct solution: a new primitive (d_instantiate_new())
combining these two in the right order - lockdep annotate, then
d_instantiate(), then the rest of unlock_new_inode().  All
combinations of d_instantiate() with unlock_new_inode() should
be converted to that.

Cc: stable@kernel.org	# 2.6.29 and later
Tested-by: default avatarMike Marshall <hubcap@omnibond.com>
Reviewed-by: default avatarAndreas Dilger <adilger@dilger.ca>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent d7760d63

fs/btrfs/inode.c

+4 −12
Original line number Diff line number Diff line
@@ -6575,8 +6575,7 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry, 
		goto out_unlock_inode;

	} else {

		btrfs_update_inode(trans, root, inode);

		unlock_new_inode(inode);

		d_instantiate(dentry, inode);

		d_instantiate_new(dentry, inode);

	}



out_unlock:
@@ -6652,8 +6651,7 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry, 
		goto out_unlock_inode;



	BTRFS_I(inode)->io_tree.ops = &btrfs_extent_io_ops;

	unlock_new_inode(inode);

	d_instantiate(dentry, inode);

	d_instantiate_new(dentry, inode);



out_unlock:

	btrfs_end_transaction(trans);
@@ -6798,12 +6796,7 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) 
	if (err)

		goto out_fail_inode;



	d_instantiate(dentry, inode);

	/*

	 * mkdir is special.  We're unlocking after we call d_instantiate

	 * to avoid a race with nfsd calling d_instantiate.

	 */

	unlock_new_inode(inode);

	d_instantiate_new(dentry, inode);

	drop_on_err = 0;



out_fail:
@@ -10246,8 +10239,7 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry, 
		goto out_unlock_inode;

	}



	unlock_new_inode(inode);

	d_instantiate(dentry, inode);

	d_instantiate_new(dentry, inode);



out_unlock:

	btrfs_end_transaction(trans);

fs/dcache.c

+22 −0
Original line number Diff line number Diff line
@@ -1899,6 +1899,28 @@ void d_instantiate(struct dentry *entry, struct inode * inode) 
}

EXPORT_SYMBOL(d_instantiate);



/*

 * This should be equivalent to d_instantiate() + unlock_new_inode(),

 * with lockdep-related part of unlock_new_inode() done before

 * anything else.  Use that instead of open-coding d_instantiate()/

 * unlock_new_inode() combinations.

 */

void d_instantiate_new(struct dentry *entry, struct inode *inode)

{

	BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));

	BUG_ON(!inode);

	lockdep_annotate_inode_mutex_key(inode);

	security_d_instantiate(entry, inode);

	spin_lock(&inode->i_lock);

	__d_instantiate(entry, inode);

	WARN_ON(!(inode->i_state & I_NEW));

	inode->i_state &= ~I_NEW;

	smp_mb();

	wake_up_bit(&inode->i_state, __I_NEW);

	spin_unlock(&inode->i_lock);

}

EXPORT_SYMBOL(d_instantiate_new);



/**

 * d_instantiate_no_diralias - instantiate a non-aliased dentry

 * @entry: dentry to complete

fs/ecryptfs/inode.c

+1 −2
Original line number Diff line number Diff line
@@ -283,8 +283,7 @@ ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry, 
		iget_failed(ecryptfs_inode);

		goto out;

	}

	unlock_new_inode(ecryptfs_inode);

	d_instantiate(ecryptfs_dentry, ecryptfs_inode);

	d_instantiate_new(ecryptfs_dentry, ecryptfs_inode);

out:

	return rc;

}

fs/ext2/namei.c

+2 −4
Original line number Diff line number Diff line
@@ -41,8 +41,7 @@ static inline int ext2_add_nondir(struct dentry *dentry, struct inode *inode) 
{

	int err = ext2_add_link(dentry, inode);

	if (!err) {

		unlock_new_inode(inode);

		d_instantiate(dentry, inode);

		d_instantiate_new(dentry, inode);

		return 0;

	}

	inode_dec_link_count(inode);
@@ -255,8 +254,7 @@ static int ext2_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode) 
	if (err)

		goto out_fail;



	unlock_new_inode(inode);

	d_instantiate(dentry, inode);

	d_instantiate_new(dentry, inode);

out:

	return err;

fs/ext4/namei.c

+2 −4
Original line number Diff line number Diff line
@@ -2411,8 +2411,7 @@ static int ext4_add_nondir(handle_t *handle, 
	int err = ext4_add_entry(handle, dentry, inode);

	if (!err) {

		ext4_mark_inode_dirty(handle, inode);

		unlock_new_inode(inode);

		d_instantiate(dentry, inode);

		d_instantiate_new(dentry, inode);

		return 0;

	}

	drop_nlink(inode);
@@ -2651,8 +2650,7 @@ static int ext4_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) 
	err = ext4_mark_inode_dirty(handle, dir);

	if (err)

		goto out_clear_inode;

	unlock_new_inode(inode);

	d_instantiate(dentry, inode);

	d_instantiate_new(dentry, inode);

	if (IS_DIRSYNC(dir))

		ext4_handle_sync(handle);