Re: ubifs, race between link and unlink/rename?

[Artem Bityutskiy <dedekind@infradead.org>]

On Fri, 2009-05-15 at 12:36 +0300, Artem Bityutskiy wrote:
> On Thu, 2009-05-14 at 01:31 +0900, hooanon05@yahoo.co.jp wrote:
> > Hello,
> > 
> > Is there a race condition in ubifs?
> > Here is a scenario.
> > 
> > Process A		Process B
> > ----------------------+---------------------------
> > create("dirA/fileA"); |
> > unlink("dirA/fileA"); |	link("dirA/fileA", "dirB/fileB");
> > 		      | unlink("dirB/fileB");
> > ----------------------+---------------------------
> 
> From: Hunter Adrian <adrian.hunter@nokia.com>
> Date: Thu, 14 May 2009 06:32:30 +0200
> Subject: [PATCH] UBIFS: return error if link and unlink race
> 
> Consider a scenario when 'vfs_link(dirA/fileA)' and
> 'vfs_unlink(dirA/fileA, dirB/fileB)' race. 'vfs_link()' does not
> lock 'dirA->i_mutex', so this is possible. Both of the functions
> lock 'fileA->i_mutex' though. Suppose 'vfs_unlink()' wins, and takes
> 'fileA->i_mutex' mutex first. Suppose 'fileA->i_nlink' is 1. In this
> case 'ubifs_unlink()' will drop the last reference, and put 'inodeA'
> to the list of orphans. After this, 'vfs_link()' will link
> 'dirB/fileB' to 'inodeA'. Thir is a problem because, for example,
> the subsequent 'vfs_unlink(dirB/fileB)' will add the same inode
> to the list of orphans.
> 
> This problem was reported by J. R. Okajima <hooanon05@yahoo.co.jp>
> 
> [Artem: add more comments, amended commit message]
> 
> Signed-off-by: Adrian Hunter <adrian.hunter@nokia.com>
> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
> ---

Pushing this patch to ubifs-2.6.git, thanks.

-- 
Best regards,
Artem Bityutskiy (Битюцкий Артём)

--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html