Deadlock in VFS on corrupted filesystem

[Jan Kara <jack@suse.cz>]

  Hello Al!

  Sami found in his testing a rather easy way to deadlock a system with
corrupted filesystem: Just have a directory D and inside D a directory
entry pointing to D itself (e.g. corrupt '.' directory entry to have other
name). Then when you try to remove the corrupted directory entry system
will deadlock because we will try to lock D both as a parent and a child.

Generally, when the directory structure is corrupted so that cycles are
created, our locking protocol is prone to deadlocks. This is somewhat
unpleasant if you have a system where you allow mounting untrusted media.
So my question is: Do we care? And if yes, how to best fix this? My naive
idea would be that we could check in d_instantiate() whether we are
creating a directory dentry and if yes, check that inode is not already
attached to a directory hierarchy (i.e. effectively forbid directory
hardlinks). But this might be a bit tricky given dentry aliases. So what
are your thoughts?

								Honza
-- 
Jan Kara <jack@suse.cz>
SUSE Labs, CR