Commit b2315096 authored by Al Viro's avatar Al Viro Committed by Jan Kara
Browse files

udf: fix the udf_iget() vs. udf_new_inode() races 



Currently udf_iget() (triggered by NFS) can race with udf_new_inode()
leading to two inode structures with the same inode number:

nfsd: iget_locked() creates inode
nfsd: try to read from disk, block on that.
udf_new_inode(): allocate inode with that inumber
udf_new_inode(): insert it into icache, set it up and dirty
udf_write_inode(): write inode into buffer cache
nfsd: get CPU again, look into buffer cache, see nice and sane on-disk
  inode, set the in-core inode from it

Fix the problem by putting inode into icache in locked state (I_NEW set)
and unlocking it only after it's fully set up.

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent d2be51cb

fs/udf/ialloc.c

+6 −1
Original line number Diff line number Diff line
@@ -124,7 +124,12 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode, int *err) 
		iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;

	inode->i_mtime = inode->i_atime = inode->i_ctime =

		iinfo->i_crtime = current_fs_time(inode->i_sb);

	insert_inode_hash(inode);

	if (unlikely(insert_inode_locked(inode) < 0)) {

		make_bad_inode(inode);

		iput(inode);

		*err = -EIO;

		return NULL;

	}

	mark_inode_dirty(inode);



	*err = 0;

fs/udf/namei.c

+7 −0
Original line number Diff line number Diff line
@@ -559,6 +559,7 @@ static int udf_add_nondir(struct dentry *dentry, struct inode *inode) 
	fi = udf_add_entry(dir, dentry, &fibh, &cfi, &err);

	if (unlikely(!fi)) {

		inode_dec_link_count(inode);

		unlock_new_inode(inode);

		iput(inode);

		return err;

	}
@@ -572,6 +573,7 @@ static int udf_add_nondir(struct dentry *dentry, struct inode *inode) 
	if (fibh.sbh != fibh.ebh)

		brelse(fibh.ebh);

	brelse(fibh.sbh);

	unlock_new_inode(inode);

	d_instantiate(dentry, inode);



	return 0;
@@ -619,6 +621,7 @@ static int udf_tmpfile(struct inode *dir, struct dentry *dentry, umode_t mode) 
	mark_inode_dirty(inode);



	d_tmpfile(dentry, inode);

	unlock_new_inode(inode);

	return 0;

}
@@ -660,6 +663,7 @@ static int udf_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) 
	fi = udf_add_entry(inode, NULL, &fibh, &cfi, &err);

	if (!fi) {

		inode_dec_link_count(inode);

		unlock_new_inode(inode);

		iput(inode);

		goto out;

	}
@@ -678,6 +682,7 @@ static int udf_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) 
	if (!fi) {

		clear_nlink(inode);

		mark_inode_dirty(inode);

		unlock_new_inode(inode);

		iput(inode);

		goto out;

	}
@@ -689,6 +694,7 @@ static int udf_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) 
	udf_write_fi(dir, &cfi, fi, &fibh, NULL, NULL);

	inc_nlink(dir);

	mark_inode_dirty(dir);

	unlock_new_inode(inode);

	d_instantiate(dentry, inode);

	if (fibh.sbh != fibh.ebh)

		brelse(fibh.ebh);
@@ -996,6 +1002,7 @@ out: 
out_no_entry:

	up_write(&iinfo->i_data_sem);

	inode_dec_link_count(inode);

	unlock_new_inode(inode);

	iput(inode);

	goto out;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE