Commit 0b8dd177 authored by Latchesar Ionkov's avatar Latchesar Ionkov Committed by Linus Torvalds
Browse files

[PATCH] v9fs: fix races in fid allocation 



Fid management cleanup.  The patch attempts to fix the races in dentry's
fid management.

Dentries don't keep the opened fids anymore, they are moved to the file
structs.  Ideally there should be no more than one fid with fidcreate equal
to zero in the dentry's list of fids.

v9fs_fid_create initializes the important fields (fid, fidcreated) before
v9fs_fid is added to the list.  v9fs_fid_lookup returns only fids that are
not created by v9fs_create.  v9fs_fid_get_created returns the fid created
by the same process by v9fs_create (if any) and removes it from dentry's
list

Signed-off-by: default avatarLatchesar Ionkov <lucho@ionkov.net>
Cc: Eric Van Hensbergen <ericvh@gmail.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent dc7b5fd6

fs/9p/fid.c

+95 −81
Original line number Diff line number Diff line
@@ -71,21 +71,28 @@ static int v9fs_fid_insert(struct v9fs_fid *fid, struct dentry *dentry) 
 *

 */



struct v9fs_fid *v9fs_fid_create(struct dentry *dentry)

struct v9fs_fid *v9fs_fid_create(struct dentry *dentry,

	struct v9fs_session_info *v9ses, int fid, int create)

{

	struct v9fs_fid *new;



	dprintk(DEBUG_9P, "fid create dentry %p, fid %d, create %d\n",

		dentry, fid, create);



	new = kmalloc(sizeof(struct v9fs_fid), GFP_KERNEL);

	if (new == NULL) {

		dprintk(DEBUG_ERROR, "Out of Memory\n");

		return ERR_PTR(-ENOMEM);

	}



	new->fid = -1;

	new->fid = fid;

	new->v9ses = v9ses;

	new->fidopen = 0;

	new->fidcreate = 0;

	new->fidcreate = create;

	new->fidclunked = 0;

	new->iounit = 0;

	new->rdir_pos = 0;

	new->rdir_fcall = NULL;



	if (v9fs_fid_insert(new, dentry) == 0)

		return new;
@@ -108,6 +115,59 @@ void v9fs_fid_destroy(struct v9fs_fid *fid) 
	kfree(fid);

}



/**

 * v9fs_fid_walk_up - walks from the process current directory

 * 	up to the specified dentry.

 */

static struct v9fs_fid *v9fs_fid_walk_up(struct dentry *dentry)

{

	int fidnum, cfidnum, err;

	struct v9fs_fid *cfid;

	struct dentry *cde;

	struct v9fs_session_info *v9ses;



	v9ses = v9fs_inode2v9ses(current->fs->pwd->d_inode);

	cfid = v9fs_fid_lookup(current->fs->pwd);

	if (cfid == NULL) {

		dprintk(DEBUG_ERROR, "process cwd doesn't have a fid\n");

		return ERR_PTR(-ENOENT);

	}



	cfidnum = cfid->fid;

	cde = current->fs->pwd;

	/* TODO: take advantage of multiwalk */



	fidnum = v9fs_get_idpool(&v9ses->fidpool);

	if (fidnum < 0) {

		dprintk(DEBUG_ERROR, "could not get a new fid num\n");

		err = -ENOENT;

		goto clunk_fid;

	}



	while (cde != dentry) {

		if (cde == cde->d_parent) {

			dprintk(DEBUG_ERROR, "can't find dentry\n");

			err = -ENOENT;

			goto clunk_fid;

		}



		err = v9fs_t_walk(v9ses, cfidnum, fidnum, "..", NULL);

		if (err < 0) {

			dprintk(DEBUG_ERROR, "problem walking to parent\n");

			goto clunk_fid;

		}



		cfidnum = fidnum;

		cde = cde->d_parent;

	}



	return v9fs_fid_create(dentry, v9ses, fidnum, 0);



clunk_fid:

	v9fs_t_clunk(v9ses, fidnum, NULL);

	return ERR_PTR(err);

}



/**

 * v9fs_fid_lookup - retrieve the right fid from a  particular dentry

 * @dentry: dentry to look for fid in
@@ -119,49 +179,25 @@ void v9fs_fid_destroy(struct v9fs_fid *fid) 
 *

 */



struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry, int type)

struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry)

{

	struct list_head *fid_list = (struct list_head *)dentry->d_fsdata;

	struct v9fs_fid *current_fid = NULL;

	struct v9fs_fid *temp = NULL;

	struct v9fs_fid *return_fid = NULL;

	int found_parent = 0;

	int found_user = 0;



	dprintk(DEBUG_9P, " dentry: %s (%p) type %d\n", dentry->d_iname, dentry,

		type);

	dprintk(DEBUG_9P, " dentry: %s (%p)\n", dentry->d_iname, dentry);



	if (fid_list && !list_empty(fid_list)) {

	if (fid_list) {

		list_for_each_entry_safe(current_fid, temp, fid_list, list) {

			if (current_fid->uid == current->uid) {

				if (return_fid == NULL) {

					if ((type == FID_OP)

					    || (!current_fid->fidopen)) {

						return_fid = current_fid;

						found_user = 1;

					}

				}

			}

			if (current_fid->pid == current->real_parent->pid) {

				if ((return_fid == NULL) || (found_parent)

				    || (found_user)) {

					if ((type == FID_OP)

					    || (!current_fid->fidopen)) {

			if (!current_fid->fidcreate) {

				return_fid = current_fid;

						found_parent = 1;

						found_user = 0;

					}

				break;

			}

		}

			if (current_fid->pid == current->pid) {

				if ((type == FID_OP) ||

				    (!current_fid->fidopen)) {



		if (!return_fid)

			return_fid = current_fid;

					found_parent = 0;

					found_user = 0;

				}

			}

		}

	}



	/* we are at the root but didn't match */
@@ -187,55 +223,33 @@ struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry, int type) 


/* XXX - there may be some duplication we can get rid of */

		if (par == dentry) {

			/* we need to fid_lookup the starting point */

			int fidnum = -1;

			int oldfid = -1;

			int result = -1;

			struct v9fs_session_info *v9ses =

			    v9fs_inode2v9ses(current->fs->pwd->d_inode);



			current_fid =

			    v9fs_fid_lookup(current->fs->pwd, FID_WALK);

			if (current_fid == NULL) {

				dprintk(DEBUG_ERROR,

					"process cwd doesn't have a fid\n");

				return return_fid;

			return_fid = v9fs_fid_walk_up(dentry);

			if (IS_ERR(return_fid))

				return_fid = NULL;

		}

	}

			oldfid = current_fid->fid;

			par = current->fs->pwd;

			/* TODO: take advantage of multiwalk */



			fidnum = v9fs_get_idpool(&v9ses->fidpool);

			if (fidnum < 0) {

				dprintk(DEBUG_ERROR,

					"could not get a new fid num\n");

	return return_fid;

}



			while (par != dentry) {

				result =

				    v9fs_t_walk(v9ses, oldfid, fidnum, "..",

						NULL);

				if (result < 0) {

					dprintk(DEBUG_ERROR,

						"problem walking to parent\n");

struct v9fs_fid *v9fs_fid_get_created(struct dentry *dentry)

{

	struct list_head *fid_list;

	struct v9fs_fid *fid, *ftmp, *ret;



	dprintk(DEBUG_9P, " dentry: %s (%p)\n", dentry->d_iname, dentry);

	fid_list = (struct list_head *)dentry->d_fsdata;

	ret = NULL;

	if (fid_list) {

		list_for_each_entry_safe(fid, ftmp, fid_list, list) {

			if (fid->fidcreate && fid->pid == current->pid) {

				list_del(&fid->list);

				ret = fid;

				break;

			}

				oldfid = fidnum;

				if (par == par->d_parent) {

					dprintk(DEBUG_ERROR,

						"can't find dentry\n");

					break;

				}

				par = par->d_parent;

			}

			if (par == dentry) {

				return_fid = v9fs_fid_create(dentry);

				return_fid->fid = fidnum;

			}

		}

	}



	return return_fid;

	dprintk(DEBUG_9P, "return %p\n", ret);

	return ret;

}

fs/9p/fid.h

+5 −2
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ 


#define FID_OP   0

#define FID_WALK 1

#define FID_CREATE 2



struct v9fs_fid {

	struct list_head list;	 /* list of fids associated with a dentry */
@@ -52,6 +53,8 @@ struct v9fs_fid { 
	struct v9fs_session_info *v9ses;	/* session info for this FID */

};



struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry, int type);

struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry);

struct v9fs_fid *v9fs_fid_get_created(struct dentry *);

void v9fs_fid_destroy(struct v9fs_fid *fid);

struct v9fs_fid *v9fs_fid_create(struct dentry *);
 
struct v9fs_fid *v9fs_fid_create(struct dentry *,

	struct v9fs_session_info *v9ses, int fid, int create);

fs/9p/vfs_dentry.c

+1 −1
Original line number Diff line number Diff line
@@ -67,7 +67,7 @@ static int v9fs_dentry_validate(struct dentry *dentry, struct nameidata *nd) 
	struct dentry *dc = current->fs->pwd;



	dprintk(DEBUG_VFS, "dentry: %s (%p)\n", dentry->d_iname, dentry);

	if (v9fs_fid_lookup(dentry, FID_OP)) {

	if (v9fs_fid_lookup(dentry)) {

		dprintk(DEBUG_VFS, "VALID\n");

		return 1;

	}

fs/9p/vfs_dir.c

+4 −7
Original line number Diff line number Diff line
@@ -197,21 +197,18 @@ int v9fs_dir_release(struct inode *inode, struct file *filp) 
	filemap_fdatawait(inode->i_mapping);



	if (fidnum >= 0) {

		fid->fidopen--;

		dprintk(DEBUG_VFS, "fidopen: %d v9f->fid: %d\n", fid->fidopen,

			fid->fid);



		if (fid->fidopen == 0) {

		if (v9fs_t_clunk(v9ses, fidnum, NULL))

			dprintk(DEBUG_ERROR, "clunk failed\n");



		v9fs_put_idpool(fid->fid, &v9ses->fidpool);

		}



		kfree(fid->rdir_fcall);

		kfree(fid);



		filp->private_data = NULL;

		v9fs_fid_destroy(fid);

	}



	d_drop(filp->f_dentry);

fs/9p/vfs_file.c

+28 −60
Original line number Diff line number Diff line
@@ -53,30 +53,36 @@ 
int v9fs_file_open(struct inode *inode, struct file *file)

{

	struct v9fs_session_info *v9ses = v9fs_inode2v9ses(inode);

	struct v9fs_fid *v9fid = v9fs_fid_lookup(file->f_dentry, FID_WALK);

	struct v9fs_fid *v9newfid = NULL;

	struct v9fs_fid *v9fid, *fid;

	struct v9fs_fcall *fcall = NULL;

	int open_mode = 0;

	unsigned int iounit = 0;

	int newfid = -1;

	long result = -1;



	dprintk(DEBUG_VFS, "inode: %p file: %p v9fid= %p\n", inode, file,

		v9fid);

	dprintk(DEBUG_VFS, "inode: %p file: %p \n", inode, file);



	v9fid = v9fs_fid_get_created(file->f_dentry);

	if (!v9fid)

		v9fid = v9fs_fid_lookup(file->f_dentry);



	if (!v9fid) {

		struct dentry *dentry = file->f_dentry;

		dprintk(DEBUG_ERROR, "Couldn't resolve fid from dentry\n");



		/* XXX - some duplication from lookup, generalize later */

		/* basically vfs_lookup is too heavy weight */

		v9fid = v9fs_fid_lookup(file->f_dentry, FID_OP);

		if (!v9fid)

		return -EBADF;

	}



		v9fid = v9fs_fid_lookup(dentry->d_parent, FID_WALK);

		if (!v9fid)

			return -EBADF;

	if (!v9fid->fidcreate) {

		fid = kmalloc(sizeof(struct v9fs_fid), GFP_KERNEL);

		if (fid == NULL) {

			dprintk(DEBUG_ERROR, "Out of Memory\n");

			return -ENOMEM;

		}



		fid->fidopen = 0;

		fid->fidcreate = 0;

		fid->fidclunked = 0;

		fid->iounit = 0;

		fid->v9ses = v9ses;



		newfid = v9fs_get_idpool(&v9ses->fidpool);

		if (newfid < 0) {
@@ -85,58 +91,16 @@ int v9fs_file_open(struct inode *inode, struct file *file) 
		}



		result =

		    v9fs_t_walk(v9ses, v9fid->fid, newfid,

				(char *)file->f_dentry->d_name.name, NULL);

		    v9fs_t_walk(v9ses, v9fid->fid, newfid, NULL, NULL);



		if (result < 0) {

			v9fs_put_idpool(newfid, &v9ses->fidpool);

			dprintk(DEBUG_ERROR, "rewalk didn't work\n");

			return -EBADF;

		}



		v9fid = v9fs_fid_create(dentry);

		if (v9fid == NULL) {

			dprintk(DEBUG_ERROR, "couldn't insert\n");

			return -ENOMEM;

		}

		v9fid->fid = newfid;

	}



	if (v9fid->fidcreate) {

		/* create case */

		newfid = v9fid->fid;

		iounit = v9fid->iounit;

		v9fid->fidcreate = 0;

	} else {

		if (!S_ISDIR(inode->i_mode))

			newfid = v9fid->fid;

		else {

			newfid = v9fs_get_idpool(&v9ses->fidpool);

			if (newfid < 0) {

				eprintk(KERN_WARNING, "allocation failed\n");

				return -ENOSPC;

			}

			/* This would be a somewhat critical clone */

			result =

			    v9fs_t_walk(v9ses, v9fid->fid, newfid, NULL,

					&fcall);

			if (result < 0) {

				dprintk(DEBUG_ERROR, "clone error: %s\n",

					FCALL_ERROR(fcall));

				kfree(fcall);

				return result;

			}



			v9newfid = v9fs_fid_create(file->f_dentry);

			v9newfid->fid = newfid;

			v9newfid->qid = v9fid->qid;

			v9newfid->iounit = v9fid->iounit;

			v9newfid->fidopen = 0;

			v9newfid->fidclunked = 0;

			v9newfid->v9ses = v9ses;

			v9fid = v9newfid;

			kfree(fcall);

		}



		fid->fid = newfid;

		v9fid = fid;

		/* TODO: do special things for O_EXCL, O_NOFOLLOW, O_SYNC */

		/* translate open mode appropriately */

		open_mode = file->f_flags & 0x3;
@@ -163,9 +127,13 @@ int v9fs_file_open(struct inode *inode, struct file *file) 


		iounit = fcall->params.ropen.iounit;

		kfree(fcall);

	} else {

		/* create case */

		newfid = v9fid->fid;

		iounit = v9fid->iounit;

		v9fid->fidcreate = 0;

	}





	file->private_data = v9fid;



	v9fid->rdir_pos = 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE