Fix sget() race with failing mount (7a4dec53) · Commits · 戴 / test

If sget() finds a matching superblock being set up, it'll grab an active reference to it and grab s_umount. That's fine - we'll wait for completion of foofs_get_sb() that way. However, if said foofs_get_sb() fails we'll end up holding the halfway-created superblock. deactivate_locked_super() called by foofs_get_sb() will just unlock the sucker since we are holding another active reference to it. What we need is a way to tell if superblock has been successfully set up. Unfortunately, neither ->s_root nor the check for MS_ACTIVE quite fit. Cheap and easy way, suitable for backport: new flag set by the (only) caller of ->get_sb(). If that flag isn't present by the time sget() grabbed s_umount on preexisting superblock it has found, it's seeing a stillborn and should just bury it with deactivate_locked_super() (and repeat the search). Longer term we want to set that flag in ->get_sb() instances (and check for it to distinguish between "sget() found us a live sb" and "sget() has allocated an sb, we need to set it up" in there, instead of checking ->s_root as we do now). Signed-off-by:

Al Viro <viro@zeniv.linux.org.uk> Cc: stable@kernel.org

fs/namespace.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1984,7 +1984,7 @@ long do_mount(char dev_name, char dir_name, char *type_page,
		if (flags & MS_RDONLY)
		mnt_flags \|= MNT_READONLY;

		flags &= ~(MS_NOSUID \| MS_NOEXEC \| MS_NODEV \| MS_ACTIVE \|
		flags &= ~(MS_NOSUID \| MS_NOEXEC \| MS_NODEV \| MS_ACTIVE \| MS_BORN \|
		MS_NOATIME \| MS_NODIRATIME \| MS_RELATIME\| MS_KERNMOUNT \|
		MS_STRICTATIME);

fs/super.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -305,8 +305,13 @@ retry:
		if (s) {
		up_write(&s->s_umount);
		destroy_super(s);
		s = NULL;
		}
		down_write(&old->s_umount);
		if (unlikely(!(old->s_flags & MS_BORN))) {
		deactivate_locked_super(old);
		goto retry;
		}
		return old;
		}
		}
		@@ -918,6 +923,7 @@ vfs_kern_mount(struct file_system_type type, int flags, const char name, void
		goto out_free_secdata;
		BUG_ON(!mnt->mnt_sb);
		WARN_ON(!mnt->mnt_sb->s_bdi);
		mnt->mnt_sb->s_flags \|= MS_BORN;

		error = security_sb_kern_mount(mnt->mnt_sb, flags, secdata);
		if (error)

include/linux/fs.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -209,6 +209,7 @@ struct inodes_stat_t {
		#define MS_KERNMOUNT (1<<22) /* this is a kern_mount call */
		#define MS_I_VERSION (1<<23) /* Update inode I_version field */
		#define MS_STRICTATIME (1<<24) /* Always perform atime updates */
		#define MS_BORN (1<<29)
		#define MS_ACTIVE (1<<30)
		#define MS_NOUSER (1<<31)

Admin message