Commit d59729f4e794f814b25ccd2aebfbe606242c4544

Authored by Theodore Ts'o
1 parent 29ae07b702

ext4: fix races in ext4_sync_parent()

Fix problems if fsync() races against a rename of a parent directory
as pointed out by Al Viro in his own inimitable way:

>While we are at it, could somebody please explain what the hell is ext4
>doing in
>static int ext4_sync_parent(struct inode *inode)
>{
>        struct writeback_control wbc;
>        struct dentry *dentry = NULL;
>        int ret = 0;
>
>        while (inode && ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY)) {
>                ext4_clear_inode_state(inode, EXT4_STATE_NEWENTRY);
>                dentry = list_entry(inode->i_dentry.next,
>                                    struct dentry, d_alias);
>                if (!dentry || !dentry->d_parent || !dentry->d_parent->d_inode)
>                        break;
>                inode = dentry->d_parent->d_inode;
>                ret = sync_mapping_buffers(inode->i_mapping);
>                ...
>Note that dentry obviously can't be NULL there.  dentry->d_parent is never
>NULL.  And dentry->d_parent would better not be negative, for crying out
>loud!  What's worse, there's no guarantees that dentry->d_parent will
>remain our parent over that sync_mapping_buffers() *and* that inode won't
>just be freed under us (after rename() and memory pressure leading to
>eviction of what used to be our dentry->d_parent)......

Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>

Showing 1 changed file with 21 additions and 5 deletions Side-by-side Diff

... ... @@ -129,15 +129,30 @@
129 129 {
130 130 struct writeback_control wbc;
131 131 struct dentry *dentry = NULL;
  132 + struct inode *next;
132 133 int ret = 0;
133 134  
134   - while (inode && ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY)) {
  135 + if (!ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY))
  136 + return 0;
  137 + inode = igrab(inode);
  138 + while (ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY)) {
135 139 ext4_clear_inode_state(inode, EXT4_STATE_NEWENTRY);
136   - dentry = list_entry(inode->i_dentry.next,
137   - struct dentry, d_alias);
138   - if (!dentry || !dentry->d_parent || !dentry->d_parent->d_inode)
  140 + dentry = NULL;
  141 + spin_lock(&inode->i_lock);
  142 + if (!list_empty(&inode->i_dentry)) {
  143 + dentry = list_first_entry(&inode->i_dentry,
  144 + struct dentry, d_alias);
  145 + dget(dentry);
  146 + }
  147 + spin_unlock(&inode->i_lock);
  148 + if (!dentry)
139 149 break;
140   - inode = dentry->d_parent->d_inode;
  150 + next = igrab(dentry->d_parent->d_inode);
  151 + dput(dentry);
  152 + if (!next)
  153 + break;
  154 + iput(inode);
  155 + inode = next;
141 156 ret = sync_mapping_buffers(inode->i_mapping);
142 157 if (ret)
143 158 break;
... ... @@ -148,6 +163,7 @@
148 163 if (ret)
149 164 break;
150 165 }
  166 + iput(inode);
151 167 return ret;
152 168 }
153 169