autofs4: fix indirect mount pending expire race

The selection of a dentry for expiration and the setting of the
AUTOFS_INF_EXPIRING flag isn't done atomically which can lead to lookups
walking into an expiring mount.

What happens is that an expire is initiated by the daemon and a dentry is
selected for expire but, since there is no lock held between the selection
and setting of the expiring flag, a process may find the flag clear and
continue walking into the mount tree at the same time the daemon attempts
the expire it.

Signed-off-by: Ian Kent <raven@themaw.net>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 3 insertions, 7 deletions

diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index 058e1800caec..5d90ed3b4b43 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -138,18 +138,14 @@ static inline int autofs4_oz_mode(struct autofs_sb_info *sbi) {
 static inline int autofs4_ispending(struct dentry *dentry)
 {
         struct autofs_info *inf = autofs4_dentry_ino(dentry);
-        int pending = 0;
 
         if (dentry->d_flags & DCACHE_AUTOFS_PENDING)
                 return 1;
 
-        if (inf) {
-                spin_lock(&inf->sbi->fs_lock);
-                pending = inf->flags & AUTOFS_INF_EXPIRING;
-                spin_unlock(&inf->sbi->fs_lock);
-        }
+        if (inf->flags & AUTOFS_INF_EXPIRING)
+                return 1;
 
-        return pending;
+        return 0;
 }
 
 static inline void autofs4_copy_atime(struct file *src, struct file *dst)