From mboxrd@z Thu Jan 1 00:00:00 1970 From: Al Viro Subject: Re: [PATCH] vfs: fix race in rcu lookup of pruned dentry Date: Mon, 18 Jul 2011 20:47:03 +0100 Message-ID: <20110718194703.GI11013@ZenIV.linux.org.uk> References: <20110717231610.GR11013@ZenIV.linux.org.uk> <20110718002524.GU11013@ZenIV.linux.org.uk> <20110718020818.GW11013@ZenIV.linux.org.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Hugh Dickins , Andrew Morton , Nick Piggin , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org To: Linus Torvalds Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On Mon, Jul 18, 2011 at 12:33:28PM -0700, Linus Torvalds wrote: > Which just makes me suspect that it's *another* case of bug in the > dentry_kill() sequence. I think the dentry_rcuwalk_barrier() thing is > crap: it doesn't *cover* the d_inode change with the write lock, it > just puts that "barrier" there, which is bogus. You can get a > successful read of the changed inode without ever failing the read > lock sequence! Huh? We do __d_drop() in there, and do that before we start messing with ->d_inode. And barrier here will make sure that anything that might have found this sucker prior to that __d_drop() will fail ->d_seq check - it bumps ->d_seq by 2... As long as ->d_inode change happens under ->d_lock and ->d_seq is bumped along with that change, we should be fine, no?