From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1754634AbbILBO7 (ORCPT <rfc822;w@1wt.eu>);
	Fri, 11 Sep 2015 21:14:59 -0400
Received: from zeniv.linux.org.uk ([195.92.253.2]:51577 "EHLO
	ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1754468AbbILBOy (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Fri, 11 Sep 2015 21:14:54 -0400
Date: Sat, 12 Sep 2015 02:14:51 +0100
From: Al Viro <viro@ZenIV.linux.org.uk>
To: =?iso-8859-1?Q?P=E1draig?= Brady <P@draigBrady.com>
Cc: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        avagin@openvz.org, Ludovic =?iso-8859-1?Q?Court=E8s?= <ludo@gnu.org>
Subject: Re: query re unlink() ... inotify ... open() race
Message-ID: <20150912011449.GP22011@ZenIV.linux.org.uk>
References: <55F371AB.20805@draigBrady.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <55F371AB.20805@draigBrady.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Sat, Sep 12, 2015 at 01:28:27AM +0100, Pádraig Brady wrote:

> The open() succeeding is surprising. Is that allowed?
> The summary of the sequence in the kernel is:
> 
>   vfs_unlink() {
>     mutex_lock(&(dentry->d_inode->i_mutex));
>     security_inode_unlink(dir, dentry);
>     try_break_deleg(target, delegated_inode);
>     dir->i_op->unlink(dir, dentry);
>     dont_mount(dentry);
>     detach_mounts(dentry);
>     mutex_unlock(&(dentry->d_inode->i_mutex));
> 
>     fsnotify_link_count(target)
>     d_delete(dentry);
>   }

... and ->unlink() is the one to decrement the link count.  With lookup
via dcache coming at some point after that.  idiotify is a red herring
here - stat(2) will report decremented link count just as well.