fs: Prevent dput race

dput() drops dentry->d_lock when it fails to lock inode->i_lock or
parent->d_lock. dentry->d_count is 0 at this point so dentry kann be
killed and freed by someone else. This leaves dput with a stale
pointer in the retry code which results in interesting kernel crashes.

Prevent this by incrementing dentry->d_count before dropping the
lock. Go back to start after dropping the lock so d_count is
decremented again.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

1 files changed, 22 insertions, 26 deletions

diff --git a/fs/dcache.c b/fs/dcache.c
index 89b9d1f14871..23a3401af2fb 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -352,48 +352,44 @@ repeat:
                 }
         }
         /* Unreachable? Get rid of it */
-        if (d_unhashed(dentry))
+        if (d_unhashed(dentry))
                 goto kill_it;
-        if (list_empty(&dentry->d_lru)) {
-                dentry->d_flags |= DCACHE_REFERENCED;
+        if (list_empty(&dentry->d_lru)) {
+                dentry->d_flags |= DCACHE_REFERENCED;
                 dentry_lru_add(dentry);
-        }
+        }
         spin_unlock(&dentry->d_lock);
         return;
 
-relock1:
-        spin_lock(&dentry->d_lock);
 kill_it:
         inode = dentry->d_inode;
-        if (inode) {
-                if (!spin_trylock(&inode->i_lock)) {
-relock2:
-                        spin_unlock(&dentry->d_lock);
-                        goto relock1;
-                }
-        }
+        if (inode && !spin_trylock(&inode->i_lock))
+                goto retry;
+
         parent = dentry->d_parent;
-        if (parent && parent != dentry) {
-                if (!spin_trylock(&parent->d_lock)) {
-                        if (inode)
-                                spin_unlock(&inode->i_lock);
-                        goto relock2;
-                }
-        }
-        if (atomic_read(&dentry->d_count)) {
-                /* This case should be fine */
-                spin_unlock(&dentry->d_lock);
-                if (parent && parent != dentry)
-                        spin_unlock(&parent->d_lock);
+        if (parent && parent != dentry && !spin_trylock(&parent->d_lock)) {
                 if (inode)
                         spin_unlock(&inode->i_lock);
-                return;
+                goto retry;
         }
+
         /* if dentry was on the d_lru list delete it from there */
         dentry_lru_del(dentry);
         dentry = d_kill(dentry);
         if (dentry)
                 goto repeat;
+        return;
+
+retry:
+        /*
+         * We are about to drop dentry->d_lock. dentry->d_count is 0
+         * so it could be freed by someone else and leave us with a
+         * stale pointer. Prevent this by increasing d_count before
+         * dropping d_lock.
+         */
+        atomic_inc(&dentry->d_count);
+        spin_unlock(&dentry->d_lock);
+        goto repeat;
 }
 
 /**