Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f03c6599 authored by Al Viro's avatar Al Viro
Browse files

sanitize vfsmount refcounting changes 



Instead of splitting refcount between (per-cpu) mnt_count
and (SMP-only) mnt_longrefs, make all references contribute
to mnt_count again and keep track of how many are longterm
ones.

Accounting rules for longterm count:
	* 1 for each fs_struct.root.mnt
	* 1 for each fs_struct.pwd.mnt
	* 1 for having non-NULL ->mnt_ns
	* decrement to 0 happens only under vfsmount lock exclusive

That allows nice common case for mntput() - since we can't drop the
final reference until after mnt_longterm has reached 0 due to the rules
above, mntput() can grab vfsmount lock shared and check mnt_longterm.
If it turns out to be non-zero (which is the common case), we know
that this is not the final mntput() and can just blindly decrement
percpu mnt_count.  Otherwise we grab vfsmount lock exclusive and
do usual decrement-and-check of percpu mnt_count.

For fs_struct.c we have mnt_make_longterm() and mnt_make_shortterm();
namespace.c uses the latter in places where we don't already hold
vfsmount lock exclusive and opencodes a few remaining spots where
we need to manipulate mnt_longterm.

Note that we mostly revert the code outside of fs/namespace.c back
to what we used to have; in particular, normal code doesn't need
to care about two kinds of references, etc.  And we get to keep
the optimization Nick's variant had bought us...

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 7b8a53fd

drivers/mtd/mtdchar.c

+1 −1
Original line number Diff line number Diff line
@@ -1201,7 +1201,7 @@ static int __init init_mtdchar(void) 
static void __exit cleanup_mtdchar(void)

{

	unregister_mtd_user(&mtdchar_notifier);

	mntput_long(mtd_inode_mnt);

	mntput(mtd_inode_mnt);

	unregister_filesystem(&mtd_inodefs_type);

	__unregister_chrdev(MTD_CHAR_MAJOR, 0, 1 << MINORBITS, "mtd");

}

fs/anon_inodes.c

+1 −1
Original line number Diff line number Diff line
@@ -233,7 +233,7 @@ static int __init anon_inode_init(void) 
	return 0;



err_mntput:

	mntput_long(anon_inode_mnt);

	mntput(anon_inode_mnt);

err_unregister_filesystem:

	unregister_filesystem(&anon_inode_fs_type);

err_exit:

fs/fs_struct.c

+24 −11
Original line number Diff line number Diff line
@@ -4,6 +4,19 @@ 
#include <linux/path.h>

#include <linux/slab.h>

#include <linux/fs_struct.h>

#include "internal.h"



static inline void path_get_longterm(struct path *path)

{

	path_get(path);

	mnt_make_longterm(path->mnt);

}



static inline void path_put_longterm(struct path *path)

{

	mnt_make_shortterm(path->mnt);

	path_put(path);

}



/*

 * Replace the fs->{rootmnt,root} with {mnt,dentry}. Put the old values.
@@ -17,11 +30,11 @@ void set_fs_root(struct fs_struct *fs, struct path *path) 
	write_seqcount_begin(&fs->seq);

	old_root = fs->root;

	fs->root = *path;

	path_get_long(path);

	path_get_longterm(path);

	write_seqcount_end(&fs->seq);

	spin_unlock(&fs->lock);

	if (old_root.dentry)

		path_put_long(&old_root);

		path_put_longterm(&old_root);

}



/*
@@ -36,12 +49,12 @@ void set_fs_pwd(struct fs_struct *fs, struct path *path) 
	write_seqcount_begin(&fs->seq);

	old_pwd = fs->pwd;

	fs->pwd = *path;

	path_get_long(path);

	path_get_longterm(path);

	write_seqcount_end(&fs->seq);

	spin_unlock(&fs->lock);



	if (old_pwd.dentry)

		path_put_long(&old_pwd);

		path_put_longterm(&old_pwd);

}



void chroot_fs_refs(struct path *old_root, struct path *new_root)
@@ -59,13 +72,13 @@ void chroot_fs_refs(struct path *old_root, struct path *new_root) 
			write_seqcount_begin(&fs->seq);

			if (fs->root.dentry == old_root->dentry

			    && fs->root.mnt == old_root->mnt) {

				path_get_long(new_root);

				path_get_longterm(new_root);

				fs->root = *new_root;

				count++;

			}

			if (fs->pwd.dentry == old_root->dentry

			    && fs->pwd.mnt == old_root->mnt) {

				path_get_long(new_root);

				path_get_longterm(new_root);

				fs->pwd = *new_root;

				count++;

			}
@@ -76,13 +89,13 @@ void chroot_fs_refs(struct path *old_root, struct path *new_root) 
	} while_each_thread(g, p);

	read_unlock(&tasklist_lock);

	while (count--)

		path_put_long(old_root);

		path_put_longterm(old_root);

}



void free_fs_struct(struct fs_struct *fs)

{

	path_put_long(&fs->root);

	path_put_long(&fs->pwd);

	path_put_longterm(&fs->root);

	path_put_longterm(&fs->pwd);

	kmem_cache_free(fs_cachep, fs);

}
@@ -118,9 +131,9 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old) 


		spin_lock(&old->lock);

		fs->root = old->root;

		path_get_long(&fs->root);

		path_get_longterm(&fs->root);

		fs->pwd = old->pwd;

		path_get_long(&fs->pwd);

		path_get_longterm(&fs->pwd);

		spin_unlock(&old->lock);

	}

	return fs;

fs/internal.h

+3 −0
Original line number Diff line number Diff line
@@ -73,6 +73,9 @@ extern struct vfsmount *copy_tree(struct vfsmount *, struct dentry *, int); 
extern int do_add_mount(struct vfsmount *, struct path *, int);

extern void mnt_clear_expiry(struct vfsmount *);



extern void mnt_make_longterm(struct vfsmount *);

extern void mnt_make_shortterm(struct vfsmount *);



extern void __init mnt_init(void);



DECLARE_BRLOCK(vfsmount_lock);

fs/namei.c

+0 −24
Original line number Diff line number Diff line
@@ -367,18 +367,6 @@ void path_get(struct path *path) 
}

EXPORT_SYMBOL(path_get);



/**

 * path_get_long - get a long reference to a path

 * @path: path to get the reference to

 *

 * Given a path increment the reference count to the dentry and the vfsmount.

 */

void path_get_long(struct path *path)

{

	mntget_long(path->mnt);

	dget(path->dentry);

}



/**

 * path_put - put a reference to a path

 * @path: path to put the reference to
@@ -392,18 +380,6 @@ void path_put(struct path *path) 
}

EXPORT_SYMBOL(path_put);



/**

 * path_put_long - put a long reference to a path

 * @path: path to put the reference to

 *

 * Given a path decrement the reference count to the dentry and the vfsmount.

 */

void path_put_long(struct path *path)

{

	dput(path->dentry);

	mntput_long(path->mnt);

}



/**

 * nameidata_drop_rcu - drop this nameidata out of rcu-walk

 * @nd: nameidata pathwalk data to drop