Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 97e7449a authored by Ian Kent's avatar Ian Kent Committed by Linus Torvalds
Browse files

autofs4: fix indirect mount pending expire race 



The selection of a dentry for expiration and the setting of the
AUTOFS_INF_EXPIRING flag isn't done atomically which can lead to lookups
walking into an expiring mount.

What happens is that an expire is initiated by the daemon and a dentry is
selected for expire but, since there is no lock held between the selection
and setting of the expiring flag, a process may find the flag clear and
continue walking into the mount tree at the same time the daemon attempts
the expire it.

Signed-off-by: default avatarIan Kent <raven@themaw.net>
Reviewed-by: default avatarJeff Moyer <jmoyer@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 26e81b31

fs/autofs4/autofs_i.h

+3 −7
Original line number Original line Diff line number Diff line
@@ -138,18 +138,14 @@ static inline int autofs4_oz_mode(struct autofs_sb_info *sbi) { 
static inline int autofs4_ispending(struct dentry *dentry)

static inline int autofs4_ispending(struct dentry *dentry)

{

{

	struct autofs_info *inf = autofs4_dentry_ino(dentry);

	struct autofs_info *inf = autofs4_dentry_ino(dentry);

	int pending = 0;





	if (dentry->d_flags & DCACHE_AUTOFS_PENDING)

	if (dentry->d_flags & DCACHE_AUTOFS_PENDING)

		return 1;

		return 1;





	if (inf) {

	if (inf->flags & AUTOFS_INF_EXPIRING)

		spin_lock(&inf->sbi->fs_lock);

		return 1;

		pending = inf->flags & AUTOFS_INF_EXPIRING;

		spin_unlock(&inf->sbi->fs_lock);

	}





	return pending;

	return 0;

}

}





static inline void autofs4_copy_atime(struct file *src, struct file *dst)

static inline void autofs4_copy_atime(struct file *src, struct file *dst)

fs/autofs4/expire.c

+35 −11
Original line number Original line Diff line number Diff line
@@ -292,6 +292,8 @@ static struct dentry *autofs4_expire_indirect(struct super_block *sb, 
	struct list_head *next;

	struct list_head *next;

	int do_now = how & AUTOFS_EXP_IMMEDIATE;

	int do_now = how & AUTOFS_EXP_IMMEDIATE;

	int exp_leaves = how & AUTOFS_EXP_LEAVES;

	int exp_leaves = how & AUTOFS_EXP_LEAVES;

	struct autofs_info *ino;

	unsigned int ino_count;





	if (!root)

	if (!root)

		return NULL;

		return NULL;
@@ -316,6 +318,9 @@ static struct dentry *autofs4_expire_indirect(struct super_block *sb, 
		dentry = dget(dentry);

		dentry = dget(dentry);

		spin_unlock(&dcache_lock);

		spin_unlock(&dcache_lock);





		spin_lock(&sbi->fs_lock);

		ino = autofs4_dentry_ino(dentry);



		/*

		/*

		 * Case 1: (i) indirect mount or top level pseudo direct mount

		 * Case 1: (i) indirect mount or top level pseudo direct mount

		 *	   (autofs-4.1).

		 *	   (autofs-4.1).
@@ -326,6 +331,11 @@ static struct dentry *autofs4_expire_indirect(struct super_block *sb, 
			DPRINTK("checking mountpoint %p %.*s",

			DPRINTK("checking mountpoint %p %.*s",

				dentry, (int)dentry->d_name.len, dentry->d_name.name);

				dentry, (int)dentry->d_name.len, dentry->d_name.name);





			/* Path walk currently on this dentry? */

			ino_count = atomic_read(&ino->count) + 2;

			if (atomic_read(&dentry->d_count) > ino_count)

				goto next;



			/* Can we umount this guy */

			/* Can we umount this guy */

			if (autofs4_mount_busy(mnt, dentry))

			if (autofs4_mount_busy(mnt, dentry))

				goto next;

				goto next;
@@ -343,23 +353,25 @@ static struct dentry *autofs4_expire_indirect(struct super_block *sb, 




		/* Case 2: tree mount, expire iff entire tree is not busy */

		/* Case 2: tree mount, expire iff entire tree is not busy */

		if (!exp_leaves) {

		if (!exp_leaves) {

			/* Lock the tree as we must expire as a whole */

			/* Path walk currently on this dentry? */

			spin_lock(&sbi->fs_lock);

			ino_count = atomic_read(&ino->count) + 1;

			if (!autofs4_tree_busy(mnt, dentry, timeout, do_now)) {

			if (atomic_read(&dentry->d_count) > ino_count)

				struct autofs_info *inf = autofs4_dentry_ino(dentry);

				goto next;





				/* Set this flag early to catch sys_chdir and the like */

			if (!autofs4_tree_busy(mnt, dentry, timeout, do_now)) {

				inf->flags |= AUTOFS_INF_EXPIRING;

				spin_unlock(&sbi->fs_lock);

				expired = dentry;

				expired = dentry;

				goto found;

				goto found;

			}

			}

			spin_unlock(&sbi->fs_lock);

		/*

		/*

		 * Case 3: pseudo direct mount, expire individual leaves

		 * Case 3: pseudo direct mount, expire individual leaves

		 *	   (autofs-4.1).

		 *	   (autofs-4.1).

		 */

		 */

		} else {

		} else {

			/* Path walk currently on this dentry? */

			ino_count = atomic_read(&ino->count) + 1;

			if (atomic_read(&dentry->d_count) > ino_count)

				goto next;



			expired = autofs4_check_leaves(mnt, dentry, timeout, do_now);

			expired = autofs4_check_leaves(mnt, dentry, timeout, do_now);

			if (expired) {

			if (expired) {

				dput(dentry);

				dput(dentry);
@@ -367,6 +379,7 @@ static struct dentry *autofs4_expire_indirect(struct super_block *sb, 
			}

			}

		}

		}

next:

next:

		spin_unlock(&sbi->fs_lock);

		dput(dentry);

		dput(dentry);

		spin_lock(&dcache_lock);

		spin_lock(&dcache_lock);

		next = next->next;

		next = next->next;
@@ -377,6 +390,9 @@ static struct dentry *autofs4_expire_indirect(struct super_block *sb, 
found:

found:

	DPRINTK("returning %p %.*s",

	DPRINTK("returning %p %.*s",

		expired, (int)expired->d_name.len, expired->d_name.name);

		expired, (int)expired->d_name.len, expired->d_name.name);

	ino = autofs4_dentry_ino(expired);

	ino->flags |= AUTOFS_INF_EXPIRING;

	spin_unlock(&sbi->fs_lock);

	spin_lock(&dcache_lock);

	spin_lock(&dcache_lock);

	list_move(&expired->d_parent->d_subdirs, &expired->d_u.d_child);

	list_move(&expired->d_parent->d_subdirs, &expired->d_u.d_child);

	spin_unlock(&dcache_lock);

	spin_unlock(&dcache_lock);
@@ -390,7 +406,9 @@ int autofs4_expire_run(struct super_block *sb, 
		      struct autofs_packet_expire __user *pkt_p)

		      struct autofs_packet_expire __user *pkt_p)

{

{

	struct autofs_packet_expire pkt;

	struct autofs_packet_expire pkt;

	struct autofs_info *ino;

	struct dentry *dentry;

	struct dentry *dentry;

	int ret = 0;





	memset(&pkt,0,sizeof pkt);

	memset(&pkt,0,sizeof pkt);
@@ -406,9 +424,14 @@ int autofs4_expire_run(struct super_block *sb, 
	dput(dentry);

	dput(dentry);





	if ( copy_to_user(pkt_p, &pkt, sizeof(struct autofs_packet_expire)) )

	if ( copy_to_user(pkt_p, &pkt, sizeof(struct autofs_packet_expire)) )

		return -EFAULT;

		ret = -EFAULT;





	return 0;

	spin_lock(&sbi->fs_lock);

	ino = autofs4_dentry_ino(dentry);

	ino->flags &= ~AUTOFS_INF_EXPIRING;

	spin_unlock(&sbi->fs_lock);



	return ret;

}

}





/* Call repeatedly until it returns -EAGAIN, meaning there's nothing

/* Call repeatedly until it returns -EAGAIN, meaning there's nothing
@@ -433,9 +456,10 @@ int autofs4_expire_multi(struct super_block *sb, struct vfsmount *mnt, 




		/* This is synchronous because it makes the daemon a

		/* This is synchronous because it makes the daemon a

                   little easier */

                   little easier */

		ino->flags |= AUTOFS_INF_EXPIRING;

		ret = autofs4_wait(sbi, dentry, NFY_EXPIRE);

		ret = autofs4_wait(sbi, dentry, NFY_EXPIRE);

		spin_lock(&sbi->fs_lock);

		ino->flags &= ~AUTOFS_INF_EXPIRING;

		ino->flags &= ~AUTOFS_INF_EXPIRING;

		spin_unlock(&sbi->fs_lock);

		dput(dentry);

		dput(dentry);

	}

	}

fs/autofs4/root.c

+27 −5
Original line number Original line Diff line number Diff line
@@ -133,7 +133,10 @@ static int try_to_fill_dentry(struct dentry *dentry, int flags) 
	/* Block on any pending expiry here; invalidate the dentry

	/* Block on any pending expiry here; invalidate the dentry

           when expiration is done to trigger mount request with a new

           when expiration is done to trigger mount request with a new

           dentry */

           dentry */

	if (ino && (ino->flags & AUTOFS_INF_EXPIRING)) {

	spin_lock(&sbi->fs_lock);

	if (ino->flags & AUTOFS_INF_EXPIRING) {

		spin_unlock(&sbi->fs_lock);



		DPRINTK("waiting for expire %p name=%.*s",

		DPRINTK("waiting for expire %p name=%.*s",

			 dentry, dentry->d_name.len, dentry->d_name.name);

			 dentry, dentry->d_name.len, dentry->d_name.name);
@@ -149,8 +152,11 @@ static int try_to_fill_dentry(struct dentry *dentry, int flags) 
		status = d_invalidate(dentry);

		status = d_invalidate(dentry);

		if (status != -EBUSY)

		if (status != -EBUSY)

			return -EAGAIN;

			return -EAGAIN;

	}





		goto cont;

	}

	spin_unlock(&sbi->fs_lock);

cont:

	DPRINTK("dentry=%p %.*s ino=%p",

	DPRINTK("dentry=%p %.*s ino=%p",

		 dentry, dentry->d_name.len, dentry->d_name.name, dentry->d_inode);

		 dentry, dentry->d_name.len, dentry->d_name.name, dentry->d_inode);
@@ -229,15 +235,21 @@ static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd) 
		goto done;

		goto done;





	/* If an expire request is pending wait for it. */

	/* If an expire request is pending wait for it. */

	if (ino && (ino->flags & AUTOFS_INF_EXPIRING)) {

	spin_lock(&sbi->fs_lock);

	if (ino->flags & AUTOFS_INF_EXPIRING) {

		spin_unlock(&sbi->fs_lock);



		DPRINTK("waiting for active request %p name=%.*s",

		DPRINTK("waiting for active request %p name=%.*s",

			dentry, dentry->d_name.len, dentry->d_name.name);

			dentry, dentry->d_name.len, dentry->d_name.name);





		status = autofs4_wait(sbi, dentry, NFY_NONE);

		status = autofs4_wait(sbi, dentry, NFY_NONE);





		DPRINTK("request done status=%d", status);

		DPRINTK("request done status=%d", status);

	}





		goto cont;

	}

	spin_unlock(&sbi->fs_lock);

cont:

	/*

	/*

	 * If the dentry contains directories then it is an

	 * If the dentry contains directories then it is an

	 * autofs multi-mount with no root mount offset. So

	 * autofs multi-mount with no root mount offset. So
@@ -292,8 +304,11 @@ static int autofs4_revalidate(struct dentry *dentry, struct nameidata *nd) 
	int status = 1;

	int status = 1;





	/* Pending dentry */

	/* Pending dentry */

	spin_lock(&sbi->fs_lock);

	if (autofs4_ispending(dentry)) {

	if (autofs4_ispending(dentry)) {

		/* The daemon never causes a mount to trigger */

		/* The daemon never causes a mount to trigger */

		spin_unlock(&sbi->fs_lock);



		if (oz_mode)

		if (oz_mode)

			return 1;

			return 1;
@@ -316,6 +331,7 @@ static int autofs4_revalidate(struct dentry *dentry, struct nameidata *nd) 




		return status;

		return status;

	}

	}

	spin_unlock(&sbi->fs_lock);





	/* Negative dentry.. invalidate if "old" */

	/* Negative dentry.. invalidate if "old" */

	if (dentry->d_inode == NULL)

	if (dentry->d_inode == NULL)
@@ -329,6 +345,7 @@ static int autofs4_revalidate(struct dentry *dentry, struct nameidata *nd) 
		DPRINTK("dentry=%p %.*s, emptydir",

		DPRINTK("dentry=%p %.*s, emptydir",

			 dentry, dentry->d_name.len, dentry->d_name.name);

			 dentry, dentry->d_name.len, dentry->d_name.name);

		spin_unlock(&dcache_lock);

		spin_unlock(&dcache_lock);



		/* The daemon never causes a mount to trigger */

		/* The daemon never causes a mount to trigger */

		if (oz_mode)

		if (oz_mode)

			return 1;

			return 1;
@@ -521,13 +538,18 @@ static struct dentry *autofs4_lookup(struct inode *dir, struct dentry *dentry, s 
		 * so it must have been successful, so just wait for it.

		 * so it must have been successful, so just wait for it.

		 */

		 */

		ino = autofs4_dentry_ino(expiring);

		ino = autofs4_dentry_ino(expiring);

		while (ino && (ino->flags & AUTOFS_INF_EXPIRING)) {

		spin_lock(&sbi->fs_lock);

		if (ino->flags & AUTOFS_INF_EXPIRING) {

			spin_unlock(&sbi->fs_lock);

			DPRINTK("wait for incomplete expire %p name=%.*s",

			DPRINTK("wait for incomplete expire %p name=%.*s",

				expiring, expiring->d_name.len,

				expiring, expiring->d_name.len,

				expiring->d_name.name);

				expiring->d_name.name);

			autofs4_wait(sbi, expiring, NFY_NONE);

			autofs4_wait(sbi, expiring, NFY_NONE);

			DPRINTK("request completed");

			DPRINTK("request completed");

			goto cont;

		}

		}

		spin_unlock(&sbi->fs_lock);

cont:

		spin_lock(&sbi->lookup_lock);

		spin_lock(&sbi->lookup_lock);

		if (!list_empty(&ino->expiring))

		if (!list_empty(&ino->expiring))

			list_del_init(&ino->expiring);

			list_del_init(&ino->expiring);