[PATCH] vfs: Release semaphore before returning in lock_mount().

[PATCH] vfs: Release semaphore before returning in lock_mount().

[santosh nayak]

From: Santosh Nayak <santoshprasadnayak@gmail.com>

There is a missing "up_write()" here. Semaphore should be released
before returning.

Signed-off-by: Santosh Nayak <santoshprasadnayak@gmail.com>
---
Destination tree "linux-next"

 fs/namespace.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/fs/namespace.c b/fs/namespace.c
index 8f412ab..d5173df 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1473,8 +1473,10 @@ retry:
 	}
 	down_write(&namespace_sem);
 	mnt = lookup_mnt(path);
-	if (likely(!mnt))
+	if (likely(!mnt)) {
+		up_write(&namespace_sem);
 		return 0;
+	}
 	up_write(&namespace_sem);
 	mutex_unlock(&path->dentry->d_inode->i_mutex);
 	path_put(path);
-- 
1.7.4.4

Re: [PATCH] vfs: Release semaphore before returning in lock_mount().

[Al Viro]

On Sun, Jun 24, 2012 at 02:48:35PM +0530, santosh nayak wrote:
> From: Santosh Nayak <santoshprasadnayak@gmail.com>
> 
> There is a missing "up_write()" here. Semaphore should be released
> before returning.

Even in a function called lock_<something> with the main effect being
to grab that semaphore (and a mutex, while we are at it)? ;-)

The whole point of lock_mount() is to get us the situation when
	1) path->{mnt,dentry} isn't overmounted by anything
	2) path->dentry is known to be alive
	3) we are guaranteed that these conditions will hold until
we do unlock_mount().
(1) is preserved by ->i_mutex; (2) - by namespace_sem.  Retry loop in
there is for handling the case when someone has raced with us and
mounted something on top of path after we'd looked it up and before
we got namespace_sem.  unlock_mount() right next to it drops both
->i_mutex and namespace_sem; these two are paired in all callers
(easily verified, since they are static in file; only 4 callers
of each in there), so we are OK.

IOW, NAK.