Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0db59e59 authored by Al Viro's avatar Al Viro
Browse files

debugfs: leave freeing a symlink body until inode eviction 



As it is, we have debugfs_remove() racing with symlink traversals.
Supply ->evict_inode() and do freeing there - inode will remain
pinned until we are done with the symlink body.

And rip the idiocy with checking if dentry is positive right after
we'd verified debugfs_positive(), which is a stronger check...

Cc: stable@vger.kernel.org
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent dca11178

fs/debugfs/inode.c

+17 −17
Original line number Diff line number Diff line
@@ -169,10 +169,19 @@ static int debugfs_show_options(struct seq_file *m, struct dentry *root) 
	return 0;

}



static void debugfs_evict_inode(struct inode *inode)

{

	truncate_inode_pages_final(&inode->i_data);

	clear_inode(inode);

	if (S_ISLNK(inode->i_mode))

		kfree(inode->i_private);

}



static const struct super_operations debugfs_super_operations = {

	.statfs		= simple_statfs,

	.remount_fs	= debugfs_remount,

	.show_options	= debugfs_show_options,

	.evict_inode	= debugfs_evict_inode,

};



static struct vfsmount *debugfs_automount(struct path *path)
@@ -511,24 +520,15 @@ static int __debugfs_remove(struct dentry *dentry, struct dentry *parent) 
	int ret = 0;



	if (debugfs_positive(dentry)) {

		if (dentry->d_inode) {

		dget(dentry);

			switch (dentry->d_inode->i_mode & S_IFMT) {

			case S_IFDIR:

		if (S_ISDIR(dentry->d_inode->i_mode))

			ret = simple_rmdir(parent->d_inode, dentry);

				break;

			case S_IFLNK:

				kfree(dentry->d_inode->i_private);

				/* fall through */

			default:

		else

			simple_unlink(parent->d_inode, dentry);

				break;

			}

		if (!ret)

			d_delete(dentry);

		dput(dentry);

	}

	}

	return ret;

}