[PATCH] autofs4: fix another race between mount and expire

Jeff Moyer has identified a race between mount and expire.

What happens is that during an expire the situation can arise that a directory
is removed and another lookup is done before the expire issues a completion
status to the kernel module.  In this case, since the the lookup gets a new
dentry, it doesn't know that there is an expire in progress and when it posts
its mount request, matches the existing expire request and waits for its
completion.  ENOENT is then returned to user space from lookup (as the dentry
passed in is now unhashed) without having performed the mount request.

The solution used here is to keep track of dentrys in this unhashed state and
reuse them, if possible, in order to preserve the flags.  Additionally, this
infrastructure will provide the framework for the reintroduction of caching of
mount fails removed earlier in development.

Signed-off-by: Ian Kent <raven@themaw.net>
Acked-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 6 insertions, 3 deletions

diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index 5e458e096ef6..26063dc84a2a 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -48,6 +48,8 @@ struct autofs_info *autofs4_init_ino(struct autofs_info *ino,
         ino->dentry = NULL;
         ino->size = 0;
 
+        INIT_LIST_HEAD(&ino->rehash);
+
         ino->last_used = jiffies;
         atomic_set(&ino->count, 0);
 
@@ -158,14 +160,13 @@ void autofs4_kill_sb(struct super_block *sb)
         if (!sbi)
                 goto out_kill_sb;
 
-        sb->s_fs_info = NULL;
-
-        if ( !sbi->catatonic )
+        if (!sbi->catatonic)
                 autofs4_catatonic_mode(sbi); /* Free wait queues, close pipe */
 
         /* Clean up and release dangling references */
         autofs4_force_release(sbi);
 
+        sb->s_fs_info = NULL;
         kfree(sbi);
 
 out_kill_sb:
@@ -336,6 +337,8 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
         mutex_init(&sbi->wq_mutex);
         spin_lock_init(&sbi->fs_lock);
         sbi->queues = NULL;
+        spin_lock_init(&sbi->rehash_lock);
+        INIT_LIST_HEAD(&sbi->rehash_list);
         s->s_blocksize = 1024;
         s->s_blocksize_bits = 10;
         s->s_magic = AUTOFS_SUPER_MAGIC;