Skip to content

Commit 1e2e547

Browse files
author
Al Viro
committed
do d_instantiate/unlock_new_inode combinations safely
For anything NFS-exported we do _not_ want to unlock new inode before it has grown an alias; original set of fixes got the ordering right, but missed the nasty complication in case of lockdep being enabled - unlock_new_inode() does lockdep_annotate_inode_mutex_key(inode) which can only be done before anyone gets a chance to touch ->i_mutex. Unfortunately, flipping the order and doing unlock_new_inode() before d_instantiate() opens a window when mkdir can race with open-by-fhandle on a guessed fhandle, leading to multiple aliases for a directory inode and all the breakage that follows from that. Correct solution: a new primitive (d_instantiate_new()) combining these two in the right order - lockdep annotate, then d_instantiate(), then the rest of unlock_new_inode(). All combinations of d_instantiate() with unlock_new_inode() should be converted to that. Cc: [email protected] # 2.6.29 and later Tested-by: Mike Marshall <[email protected]> Reviewed-by: Andreas Dilger <[email protected]> Signed-off-by: Al Viro <[email protected]>
1 parent d7760d6 commit 1e2e547

File tree

14 files changed

+57
-72
lines changed

14 files changed

+57
-72
lines changed

‎fs/btrfs/inode.c

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6575,8 +6575,7 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
65756575
goto out_unlock_inode;
65766576
} else {
65776577
btrfs_update_inode(trans, root, inode);
6578-
unlock_new_inode(inode);
6579-
d_instantiate(dentry, inode);
6578+
d_instantiate_new(dentry, inode);
65806579
}
65816580

65826581
out_unlock:
@@ -6652,8 +6651,7 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
66526651
goto out_unlock_inode;
66536652

66546653
BTRFS_I(inode)->io_tree.ops = &btrfs_extent_io_ops;
6655-
unlock_new_inode(inode);
6656-
d_instantiate(dentry, inode);
6654+
d_instantiate_new(dentry, inode);
66576655

66586656
out_unlock:
66596657
btrfs_end_transaction(trans);
@@ -6798,12 +6796,7 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
67986796
if (err)
67996797
goto out_fail_inode;
68006798

6801-
d_instantiate(dentry, inode);
6802-
/*
6803-
* mkdir is special. We're unlocking after we call d_instantiate
6804-
* to avoid a race with nfsd calling d_instantiate.
6805-
*/
6806-
unlock_new_inode(inode);
6799+
d_instantiate_new(dentry, inode);
68076800
drop_on_err = 0;
68086801

68096802
out_fail:
@@ -10246,8 +10239,7 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
1024610239
goto out_unlock_inode;
1024710240
}
1024810241

10249-
unlock_new_inode(inode);
10250-
d_instantiate(dentry, inode);
10242+
d_instantiate_new(dentry, inode);
1025110243

1025210244
out_unlock:
1025310245
btrfs_end_transaction(trans);

‎fs/dcache.c

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1899,6 +1899,28 @@ void d_instantiate(struct dentry *entry, struct inode * inode)
18991899
}
19001900
EXPORT_SYMBOL(d_instantiate);
19011901

1902+
/*
1903+
* This should be equivalent to d_instantiate() + unlock_new_inode(),
1904+
* with lockdep-related part of unlock_new_inode() done before
1905+
* anything else. Use that instead of open-coding d_instantiate()/
1906+
* unlock_new_inode() combinations.
1907+
*/
1908+
void d_instantiate_new(struct dentry *entry, struct inode *inode)
1909+
{
1910+
BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
1911+
BUG_ON(!inode);
1912+
lockdep_annotate_inode_mutex_key(inode);
1913+
security_d_instantiate(entry, inode);
1914+
spin_lock(&inode->i_lock);
1915+
__d_instantiate(entry, inode);
1916+
WARN_ON(!(inode->i_state & I_NEW));
1917+
inode->i_state &= ~I_NEW;
1918+
smp_mb();
1919+
wake_up_bit(&inode->i_state, __I_NEW);
1920+
spin_unlock(&inode->i_lock);
1921+
}
1922+
EXPORT_SYMBOL(d_instantiate_new);
1923+
19021924
/**
19031925
* d_instantiate_no_diralias - instantiate a non-aliased dentry
19041926
* @entry: dentry to complete

‎fs/ecryptfs/inode.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -283,8 +283,7 @@ ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry,
283283
iget_failed(ecryptfs_inode);
284284
goto out;
285285
}
286-
unlock_new_inode(ecryptfs_inode);
287-
d_instantiate(ecryptfs_dentry, ecryptfs_inode);
286+
d_instantiate_new(ecryptfs_dentry, ecryptfs_inode);
288287
out:
289288
return rc;
290289
}

‎fs/ext2/namei.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,7 @@ static inline int ext2_add_nondir(struct dentry *dentry, struct inode *inode)
4141
{
4242
int err = ext2_add_link(dentry, inode);
4343
if (!err) {
44-
unlock_new_inode(inode);
45-
d_instantiate(dentry, inode);
44+
d_instantiate_new(dentry, inode);
4645
return 0;
4746
}
4847
inode_dec_link_count(inode);
@@ -255,8 +254,7 @@ static int ext2_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode)
255254
if (err)
256255
goto out_fail;
257256

258-
unlock_new_inode(inode);
259-
d_instantiate(dentry, inode);
257+
d_instantiate_new(dentry, inode);
260258
out:
261259
return err;
262260

‎fs/ext4/namei.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2411,8 +2411,7 @@ static int ext4_add_nondir(handle_t *handle,
24112411
int err = ext4_add_entry(handle, dentry, inode);
24122412
if (!err) {
24132413
ext4_mark_inode_dirty(handle, inode);
2414-
unlock_new_inode(inode);
2415-
d_instantiate(dentry, inode);
2414+
d_instantiate_new(dentry, inode);
24162415
return 0;
24172416
}
24182417
drop_nlink(inode);
@@ -2651,8 +2650,7 @@ static int ext4_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
26512650
err = ext4_mark_inode_dirty(handle, dir);
26522651
if (err)
26532652
goto out_clear_inode;
2654-
unlock_new_inode(inode);
2655-
d_instantiate(dentry, inode);
2653+
d_instantiate_new(dentry, inode);
26562654
if (IS_DIRSYNC(dir))
26572655
ext4_handle_sync(handle);
26582656

‎fs/f2fs/namei.c

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -294,8 +294,7 @@ static int f2fs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
294294

295295
alloc_nid_done(sbi, ino);
296296

297-
d_instantiate(dentry, inode);
298-
unlock_new_inode(inode);
297+
d_instantiate_new(dentry, inode);
299298

300299
if (IS_DIRSYNC(dir))
301300
f2fs_sync_fs(sbi->sb, 1);
@@ -597,8 +596,7 @@ static int f2fs_symlink(struct inode *dir, struct dentry *dentry,
597596
err = page_symlink(inode, disk_link.name, disk_link.len);
598597

599598
err_out:
600-
d_instantiate(dentry, inode);
601-
unlock_new_inode(inode);
599+
d_instantiate_new(dentry, inode);
602600

603601
/*
604602
* Let's flush symlink data in order to avoid broken symlink as much as
@@ -661,8 +659,7 @@ static int f2fs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
661659

662660
alloc_nid_done(sbi, inode->i_ino);
663661

664-
d_instantiate(dentry, inode);
665-
unlock_new_inode(inode);
662+
d_instantiate_new(dentry, inode);
666663

667664
if (IS_DIRSYNC(dir))
668665
f2fs_sync_fs(sbi->sb, 1);
@@ -713,8 +710,7 @@ static int f2fs_mknod(struct inode *dir, struct dentry *dentry,
713710

714711
alloc_nid_done(sbi, inode->i_ino);
715712

716-
d_instantiate(dentry, inode);
717-
unlock_new_inode(inode);
713+
d_instantiate_new(dentry, inode);
718714

719715
if (IS_DIRSYNC(dir))
720716
f2fs_sync_fs(sbi->sb, 1);

‎fs/jffs2/dir.c

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -209,8 +209,7 @@ static int jffs2_create(struct inode *dir_i, struct dentry *dentry,
209209
__func__, inode->i_ino, inode->i_mode, inode->i_nlink,
210210
f->inocache->pino_nlink, inode->i_mapping->nrpages);
211211

212-
unlock_new_inode(inode);
213-
d_instantiate(dentry, inode);
212+
d_instantiate_new(dentry, inode);
214213
return 0;
215214

216215
fail:
@@ -430,8 +429,7 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
430429
mutex_unlock(&dir_f->sem);
431430
jffs2_complete_reservation(c);
432431

433-
unlock_new_inode(inode);
434-
d_instantiate(dentry, inode);
432+
d_instantiate_new(dentry, inode);
435433
return 0;
436434

437435
fail:
@@ -575,8 +573,7 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, umode_t mode
575573
mutex_unlock(&dir_f->sem);
576574
jffs2_complete_reservation(c);
577575

578-
unlock_new_inode(inode);
579-
d_instantiate(dentry, inode);
576+
d_instantiate_new(dentry, inode);
580577
return 0;
581578

582579
fail:
@@ -747,8 +744,7 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, umode_t mode
747744
mutex_unlock(&dir_f->sem);
748745
jffs2_complete_reservation(c);
749746

750-
unlock_new_inode(inode);
751-
d_instantiate(dentry, inode);
747+
d_instantiate_new(dentry, inode);
752748
return 0;
753749

754750
fail:

‎fs/jfs/namei.c

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -178,8 +178,7 @@ static int jfs_create(struct inode *dip, struct dentry *dentry, umode_t mode,
178178
unlock_new_inode(ip);
179179
iput(ip);
180180
} else {
181-
unlock_new_inode(ip);
182-
d_instantiate(dentry, ip);
181+
d_instantiate_new(dentry, ip);
183182
}
184183

185184
out2:
@@ -313,8 +312,7 @@ static int jfs_mkdir(struct inode *dip, struct dentry *dentry, umode_t mode)
313312
unlock_new_inode(ip);
314313
iput(ip);
315314
} else {
316-
unlock_new_inode(ip);
317-
d_instantiate(dentry, ip);
315+
d_instantiate_new(dentry, ip);
318316
}
319317

320318
out2:
@@ -1059,8 +1057,7 @@ static int jfs_symlink(struct inode *dip, struct dentry *dentry,
10591057
unlock_new_inode(ip);
10601058
iput(ip);
10611059
} else {
1062-
unlock_new_inode(ip);
1063-
d_instantiate(dentry, ip);
1060+
d_instantiate_new(dentry, ip);
10641061
}
10651062

10661063
out2:
@@ -1447,8 +1444,7 @@ static int jfs_mknod(struct inode *dir, struct dentry *dentry,
14471444
unlock_new_inode(ip);
14481445
iput(ip);
14491446
} else {
1450-
unlock_new_inode(ip);
1451-
d_instantiate(dentry, ip);
1447+
d_instantiate_new(dentry, ip);
14521448
}
14531449

14541450
out1:

‎fs/nilfs2/namei.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,7 @@ static inline int nilfs_add_nondir(struct dentry *dentry, struct inode *inode)
4646
int err = nilfs_add_link(dentry, inode);
4747

4848
if (!err) {
49-
d_instantiate(dentry, inode);
50-
unlock_new_inode(inode);
49+
d_instantiate_new(dentry, inode);
5150
return 0;
5251
}
5352
inode_dec_link_count(inode);
@@ -243,8 +242,7 @@ static int nilfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
243242
goto out_fail;
244243

245244
nilfs_mark_inode_dirty(inode);
246-
d_instantiate(dentry, inode);
247-
unlock_new_inode(inode);
245+
d_instantiate_new(dentry, inode);
248246
out:
249247
if (!err)
250248
err = nilfs_transaction_commit(dir->i_sb);

‎fs/orangefs/namei.c

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -75,8 +75,7 @@ static int orangefs_create(struct inode *dir,
7575
get_khandle_from_ino(inode),
7676
dentry);
7777

78-
d_instantiate(dentry, inode);
79-
unlock_new_inode(inode);
78+
d_instantiate_new(dentry, inode);
8079
orangefs_set_timeout(dentry);
8180
ORANGEFS_I(inode)->getattr_time = jiffies - 1;
8281
ORANGEFS_I(inode)->getattr_mask = STATX_BASIC_STATS;
@@ -332,8 +331,7 @@ static int orangefs_symlink(struct inode *dir,
332331
"Assigned symlink inode new number of %pU\n",
333332
get_khandle_from_ino(inode));
334333

335-
d_instantiate(dentry, inode);
336-
unlock_new_inode(inode);
334+
d_instantiate_new(dentry, inode);
337335
orangefs_set_timeout(dentry);
338336
ORANGEFS_I(inode)->getattr_time = jiffies - 1;
339337
ORANGEFS_I(inode)->getattr_mask = STATX_BASIC_STATS;
@@ -402,8 +400,7 @@ static int orangefs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
402400
"Assigned dir inode new number of %pU\n",
403401
get_khandle_from_ino(inode));
404402

405-
d_instantiate(dentry, inode);
406-
unlock_new_inode(inode);
403+
d_instantiate_new(dentry, inode);
407404
orangefs_set_timeout(dentry);
408405
ORANGEFS_I(inode)->getattr_time = jiffies - 1;
409406
ORANGEFS_I(inode)->getattr_mask = STATX_BASIC_STATS;

‎fs/reiserfs/namei.c

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -687,8 +687,7 @@ static int reiserfs_create(struct inode *dir, struct dentry *dentry, umode_t mod
687687
reiserfs_update_inode_transaction(inode);
688688
reiserfs_update_inode_transaction(dir);
689689

690-
unlock_new_inode(inode);
691-
d_instantiate(dentry, inode);
690+
d_instantiate_new(dentry, inode);
692691
retval = journal_end(&th);
693692

694693
out_failed:
@@ -771,8 +770,7 @@ static int reiserfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode
771770
goto out_failed;
772771
}
773772

774-
unlock_new_inode(inode);
775-
d_instantiate(dentry, inode);
773+
d_instantiate_new(dentry, inode);
776774
retval = journal_end(&th);
777775

778776
out_failed:
@@ -871,8 +869,7 @@ static int reiserfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
871869
/* the above add_entry did not update dir's stat data */
872870
reiserfs_update_sd(&th, dir);
873871

874-
unlock_new_inode(inode);
875-
d_instantiate(dentry, inode);
872+
d_instantiate_new(dentry, inode);
876873
retval = journal_end(&th);
877874
out_failed:
878875
reiserfs_write_unlock(dir->i_sb);
@@ -1187,8 +1184,7 @@ static int reiserfs_symlink(struct inode *parent_dir,
11871184
goto out_failed;
11881185
}
11891186

1190-
unlock_new_inode(inode);
1191-
d_instantiate(dentry, inode);
1187+
d_instantiate_new(dentry, inode);
11921188
retval = journal_end(&th);
11931189
out_failed:
11941190
reiserfs_write_unlock(parent_dir->i_sb);

‎fs/udf/namei.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -622,8 +622,7 @@ static int udf_add_nondir(struct dentry *dentry, struct inode *inode)
622622
if (fibh.sbh != fibh.ebh)
623623
brelse(fibh.ebh);
624624
brelse(fibh.sbh);
625-
unlock_new_inode(inode);
626-
d_instantiate(dentry, inode);
625+
d_instantiate_new(dentry, inode);
627626

628627
return 0;
629628
}
@@ -733,8 +732,7 @@ static int udf_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
733732
inc_nlink(dir);
734733
dir->i_ctime = dir->i_mtime = current_time(dir);
735734
mark_inode_dirty(dir);
736-
unlock_new_inode(inode);
737-
d_instantiate(dentry, inode);
735+
d_instantiate_new(dentry, inode);
738736
if (fibh.sbh != fibh.ebh)
739737
brelse(fibh.ebh);
740738
brelse(fibh.sbh);

‎fs/ufs/namei.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,7 @@ static inline int ufs_add_nondir(struct dentry *dentry, struct inode *inode)
3939
{
4040
int err = ufs_add_link(dentry, inode);
4141
if (!err) {
42-
unlock_new_inode(inode);
43-
d_instantiate(dentry, inode);
42+
d_instantiate_new(dentry, inode);
4443
return 0;
4544
}
4645
inode_dec_link_count(inode);
@@ -193,8 +192,7 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode)
193192
if (err)
194193
goto out_fail;
195194

196-
unlock_new_inode(inode);
197-
d_instantiate(dentry, inode);
195+
d_instantiate_new(dentry, inode);
198196
return 0;
199197

200198
out_fail:

‎include/linux/dcache.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -224,6 +224,7 @@ extern seqlock_t rename_lock;
224224
* These are the low-level FS interfaces to the dcache..
225225
*/
226226
extern void d_instantiate(struct dentry *, struct inode *);
227+
extern void d_instantiate_new(struct dentry *, struct inode *);
227228
extern struct dentry * d_instantiate_unique(struct dentry *, struct inode *);
228229
extern struct dentry * d_instantiate_anon(struct dentry *, struct inode *);
229230
extern int d_instantiate_no_diralias(struct dentry *, struct inode *);

0 commit comments

Comments
 (0)