Re: Linux 2.4.33-rc1

Willy Tarreau
2006-06-19T08:10:21Z

Hi Grant,

OK, it does *really* crash in vfs_unlink(), during the double_up on
dentry->inode-i_zombie (dentry->inode = NULL).

I suggest the following fix, I hope that it is correct and is not subject
to any race condition :

--- ./fs/namei.c.orig 2006-06-19 09:39:52.000000000 +0200
+++ ./fs/namei.c 2006-06-19 09:51:09.000000000 +0200
@@ -1478,12 +1478,14 @@
int vfs_unlink(struct inode *dir, struct dentry *dentry)
{
int error;
+ struct inode *inode;

error = may_delete(dir, dentry, 0);
if (error)
return error;

- double_down(&dir->i_zombie, &dentry->d_inode->i_zombie);
+ inode = dentry->d_inode;
+ double_down(&dir->i_zombie, &inode->i_zombie);
error = -EPERM;
if (dir->i_op && dir->i_op->unlink) {
DQUOT_INIT(dir);
@@ -1495,7 +1497,7 @@
unlock_kernel();
}
}
- double_up(&dir->i_zombie, &dentry->d_inode->i_zombie);
+ double_up(&dir->i_zombie, &inode->i_zombie);
if (!error) {
d_delete(dentry);
inode_dir_notify(dir, DN_DELETE);

I think it will *not* oops anymore with this fix, but I'd like someone to
review it to ensure that it is valid.

Cheers,
Willy