public inbox for linux-xfs@vger.kernel.org
 help / color / mirror / Atom feed
* [REVIEW 0 of 4] Fix xfs_iunpin use after free badness
@ 2006-10-24  7:15 David Chinner
  0 siblings, 0 replies; only message in thread
From: David Chinner @ 2006-10-24  7:15 UTC (permalink / raw)
  To: xfs; +Cc: t-nagano, xfs-dev

The following 4 patches fix the long standing issues with
xfs_iunpin accessing the linux inode after it has been freed.

The first patch cleans up the i_flags_lock handling and the
setting and clearing of the i_flags. This has
been posted before in a different context, and is simply a cleanup patch.

The second patch removes the need for grabbing the linux
inode in xfs_iunpin(). This causes deadlocks when the xfslogd
drops the final reference to an inode and needs to issue a transaction
when the log is full. We can do this by providing a guarantee
external to xfs_iunpin() that when either of the XFS_IRECLAIM
or XFS_IRECLAIMABLE flags are set on the xfs inode there is
no linux inode to look up.

The third patch fixes the xfs_iget_core() handling of the
XFS_IRECLAIMABLE flag so it doesn't violate the guarantee we
need to provide to xfs_iunpin() w.r.t. the existence of a
linux inode.

The last patch closes a race condition in xfs_iunpin()
as we need to guarantee the atomicity of the last unpin
and the checking of the XFS_IRECLAIM* flags otherwise
pre-emption or interrupt can cause us to race with
xfs_iget_core() which would now see the inode as unpinned
and hence clear the XFS_IRECLAIMABLE flag.

Many thanks go to Takenori Nagano for his help in getting to
the bottom of this issue and the testing that he has done.

Cheers,

Dave.
-- 
Dave Chinner
Principal Engineer
SGI Australian Software Group

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2006-10-24  7:16 UTC | newest]

Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-10-24  7:15 [REVIEW 0 of 4] Fix xfs_iunpin use after free badness David Chinner

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox