Re: system panic while dentry reference count overflow

[Al Viro <viro@zeniv.linux.org.uk>]

On Tue, May 07, 2019 at 08:26:06AM -0700, Linus Torvalds wrote:
> On Mon, May 6, 2019 at 9:15 PM Al Viro <viro@zeniv.linux.org.uk> wrote:
> >
> > Umm...  Where would you put the cutoff for try_dget()?  1G?  Because
> > 2G-<something relatively small> is risky - have it reached, then
> > get the rest of the way to 2G by normal dget() and you've got trouble.
> 
> I'd make the limit be 2G exactly like the page count. Negative counts
> are fine - they work exactly like large integers. It's only 0 that is
> special.

Negative ->d_lockref.count are used for "lockref is dead"...

>  - add the "limit negative dentries" patches that were already written
> for other reasons by Waiman Long.

Irrelevant here, IMO - negative or not (and evictable or pinned, for that
matter) it's easier solved by having d_alloc() fail on parent's ->d_count
overflow.  And I'm pretty sure we can hit that crap without creating any
negative dentries.