ocfs2: fix a tiny race when truncate dio orohaned entry

Once dio crashed it will leave an entry in orphan dir.  And orphan scan
will take care of the clean up.  There is a tiny race case that the same
entry will be truncated twice and then trigger the BUG in
ocfs2_del_inode_from_orphan.

Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
Cc: Mark Fasheh <mfasheh@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 11 insertions, 1 deletions

diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index f906a250da6a..395f4b356baa 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -925,13 +925,23 @@ clean_orphan:
                 int update_isize = written > 0 ? 1 : 0;
                 loff_t end = update_isize ? offset + written : 0;
 
-                tmp_ret = ocfs2_del_inode_from_orphan(osb, inode,
+                tmp_ret = ocfs2_inode_lock(inode, &di_bh, 1);
+                if (tmp_ret < 0) {
+                        ret = tmp_ret;
+                        mlog_errno(ret);
+                        goto out;
+                }
+
+                tmp_ret = ocfs2_del_inode_from_orphan(osb, inode, di_bh,
                                 update_isize, end);
                 if (tmp_ret < 0) {
                         ret = tmp_ret;
+                        mlog_errno(ret);
                         goto out;
                 }
 
+                ocfs2_inode_unlock(inode, 1);
+
                 tmp_ret = jbd2_journal_force_commit(journal);
                 if (tmp_ret < 0) {
                         ret = tmp_ret;