Commit 6b6751f7 authored May 06, 2014 by Ian Kent Committed by Linus Torvalds May 06, 2014

autofs: fix lockref lookup



autofs needs to be able to see private data dentry flags for its dentrys
that are being created but not yet hashed and for its dentrys that have
been rmdir()ed but not yet freed.  It needs to do this so it can block
processes in these states until a status has been returned to indicate
the given operation is complete.

It does this by keeping two lists, active and expring, of dentrys in
this state and uses ->d_release() to keep them stable while it checks
the reference count to determine if they should be used.

But with the recent lockref changes dentrys being freed sometimes don't
transition to a reference count of 0 before being freed so autofs can
occassionally use a dentry that is invalid which can lead to a panic.

Signed-off-by: Ian Kent <raven@themaw.net>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 139b6a6f

fs/autofs4/root.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -179,7 +179,7 @@ static struct dentry autofs4_lookup_active(struct dentry dentry)
		spin_lock(&active->d_lock);

		/* Already gone? */
		if (!d_count(active))
		if ((int) d_count(active) <= 0)
		goto next;

		qstr = &active->d_name;
		@@ -230,7 +230,7 @@ static struct dentry autofs4_lookup_expiring(struct dentry dentry)

		spin_lock(&expiring->d_lock);

		/* Bad luck, we've already been dentry_iput */
		/* We've already been dentry_iput or unlinked */
		if (!expiring->d_inode)
		goto next;

Admin message