diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2014-09-04 15:38:11 +0200 |
|---|---|---|
| committer | Jan Kara <jack@suse.cz> | 2014-09-04 21:37:41 +0200 |
| commit | b231509616feb911c2a7a8814d58c0014ef5b17f (patch) | |
| tree | da9d231b09ee58637fb671310291432929c9db56 /fs/udf/ialloc.c | |
| parent | udf: merge the pieces inserting a new non-directory object into directory (diff) | |
| download | linux-b231509616feb911c2a7a8814d58c0014ef5b17f.tar.xz linux-b231509616feb911c2a7a8814d58c0014ef5b17f.zip | |
udf: fix the udf_iget() vs. udf_new_inode() races
Currently udf_iget() (triggered by NFS) can race with udf_new_inode()
leading to two inode structures with the same inode number:
nfsd: iget_locked() creates inode
nfsd: try to read from disk, block on that.
udf_new_inode(): allocate inode with that inumber
udf_new_inode(): insert it into icache, set it up and dirty
udf_write_inode(): write inode into buffer cache
nfsd: get CPU again, look into buffer cache, see nice and sane on-disk
inode, set the in-core inode from it
Fix the problem by putting inode into icache in locked state (I_NEW set)
and unlocking it only after it's fully set up.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'fs/udf/ialloc.c')
| -rw-r--r-- | fs/udf/ialloc.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/fs/udf/ialloc.c b/fs/udf/ialloc.c index 647370d70175..598f33bdcd26 100644 --- a/fs/udf/ialloc.c +++ b/fs/udf/ialloc.c @@ -124,7 +124,12 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode, int *err) iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG; inode->i_mtime = inode->i_atime = inode->i_ctime = iinfo->i_crtime = current_fs_time(inode->i_sb); - insert_inode_hash(inode); + if (unlikely(insert_inode_locked(inode) < 0)) { + make_bad_inode(inode); + iput(inode); + *err = -EIO; + return NULL; + } mark_inode_dirty(inode); *err = 0; |