From mboxrd@z Thu Jan 1 00:00:00 1970 From: "J. Bruce Fields" Subject: [PATCH 03/11] dcache: close d_move race in d_splice_alias Date: Wed, 4 Jun 2014 17:20:55 -0400 Message-ID: <1401916863-7916-4-git-send-email-bfields@redhat.com> References: <1401916863-7916-1-git-send-email-bfields@redhat.com> Cc: Christoph Hellwig , linux-fsdevel@vger.kernel.org, "J. Bruce Fields" To: Al Viro Return-path: Received: from fieldses.org ([174.143.236.118]:48771 "EHLO fieldses.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751329AbaFDVVa (ORCPT ); Wed, 4 Jun 2014 17:21:30 -0400 In-Reply-To: <1401916863-7916-1-git-send-email-bfields@redhat.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: From: "J. Bruce Fields" d_splice_alias will d_move an IS_ROOT() directory dentry into place if one exists. This should be safe as long as the dentry remains IS_ROOT, but I can't see what guarantees that: once we drop the i_lock all we hold here is the i_mutex on an unrelated parent directory. Instead copy the logic of d_materialise_unique. Reviewed-by: Christoph Hellwig Signed-off-by: J. Bruce Fields --- fs/dcache.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/dcache.c b/fs/dcache.c index 467389f..a833e97 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -2613,9 +2613,14 @@ struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry) new = __d_find_alias(inode, 1); if (new) { BUG_ON(!(new->d_flags & DCACHE_DISCONNECTED)); + write_seqlock(&rename_lock); + __d_materialise_dentry(dentry, new); + write_sequnlock(&rename_lock); + __d_drop(new); + _d_rehash(new); + spin_unlock(&new->d_lock); spin_unlock(&inode->i_lock); security_d_instantiate(new, inode); - d_move(new, dentry); iput(inode); } else { /* already taking inode->i_lock, so d_add() by hand */ -- 1.7.9.5