ocfs2: fix a tiny race when truncate dio orohaned entry

Once dio crashed it will leave an entry in orphan dir.  And orphan scan
will take care of the clean up.  There is a tiny race case that the same
entry will be truncated twice and then trigger the BUG in
ocfs2_del_inode_from_orphan.

Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
Cc: Mark Fasheh <mfasheh@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 5 insertions, 17 deletions

diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 176fe6afd94e..08a7a5b70494 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -2670,30 +2670,22 @@ bail:
 }
 
 int ocfs2_del_inode_from_orphan(struct ocfs2_super *osb,
-                struct inode *inode, int update_isize,
-                loff_t end)
+                struct inode *inode, struct buffer_head *di_bh,
+                int update_isize, loff_t end)
 {
         struct inode *orphan_dir_inode = NULL;
         struct buffer_head *orphan_dir_bh = NULL;
-        struct buffer_head *di_bh = NULL;
-        struct ocfs2_dinode *di = NULL;
+        struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
         handle_t *handle = NULL;
         int status = 0;
 
-        status = ocfs2_inode_lock(inode, &di_bh, 1);
-        if (status < 0) {
-                mlog_errno(status);
-                goto bail;
-        }
-        di = (struct ocfs2_dinode *) di_bh->b_data;
-
         orphan_dir_inode = ocfs2_get_system_file_inode(osb,
                         ORPHAN_DIR_SYSTEM_INODE,
                         le16_to_cpu(di->i_dio_orphaned_slot));
         if (!orphan_dir_inode) {
                 status = -ENOENT;
                 mlog_errno(status);
-                goto bail_unlock_inode;
+                goto bail;
         }
 
         mutex_lock(&orphan_dir_inode->i_mutex);
@@ -2702,7 +2694,7 @@ int ocfs2_del_inode_from_orphan(struct ocfs2_super *osb,
                 mutex_unlock(&orphan_dir_inode->i_mutex);
                 iput(orphan_dir_inode);
                 mlog_errno(status);
-                goto bail_unlock_inode;
+                goto bail;
         }
 
         handle = ocfs2_start_trans(osb,
@@ -2749,10 +2741,6 @@ bail_unlock_orphan:
         brelse(orphan_dir_bh);
         iput(orphan_dir_inode);
 
-bail_unlock_inode:
-        ocfs2_inode_unlock(inode, 1);
-        brelse(di_bh);
-
 bail:
         return status;
 }