O_TMPFILE fs corruption (Re: Linux 3.11-rc4)

[Andy Lutomirski <luto@MIT.EDU>]

On 08/04/2013 02:09 PM, Linus Torvalds wrote:
> It's that time of the week again..

I still get filesystem corruption with O_TMPFILE.  The program below, 
run as flinktest foo proc (or flinktest foo linkat if you're root) will 
produce a bogus inode.  On ext4, once the inode is gone from cache, the 
inode will be impossible to delete and will require a fsck to fix

A patch (not necessarily the appropriate fix) is here:

http://article.gmane.org/gmane.linux.kernel/1537088

--- cut here ---

#include <stdio.h>
#include <err.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>

#define __O_TMPFILE 020000000
#define O_TMPFILE (__O_TMPFILE | O_DIRECTORY)
#define AT_EMPTY_PATH 0x1000

int main(int argc, char **argv)
{
   char buf[128];

   if (argc != 3)
     errx(1, "Usage: flinktest PATH linkat|proc");

   int fd = open(".", O_TMPFILE | O_RDWR, 0600);
   if (fd == -1)
     err(1, "O_TMPFILE");
   write(fd, "test", 4);

   if (!strcmp(argv[2], "linkat")) {
     if (linkat(fd, "", AT_FDCWD, argv[1], AT_EMPTY_PATH) != 0)
       err(1, "linkat");
   } else if (!strcmp(argv[2], "proc")) {
     sprintf(buf, "/proc/self/fd/%d", fd);
     if (linkat(AT_FDCWD, buf, AT_FDCWD, argv[1], AT_SYMLINK_FOLLOW) != 0)
       err(1, "linkat");
   } else {
     errx(1, "invalid mode");
   }
   return 0;
}