cifs: fix potential races in cifs_revalidate_mapping

The handling of the CIFS_INO_INVALID_MAPPING flag is racy. It's possible
for two tasks to attempt to revalidate the mapping at the same time. The
first sees that CIFS_INO_INVALID_MAPPING is set. It clears the flag and
then calls invalidate_inode_pages2 to start shooting down the pagecache.

While that's going on, another task checks the flag and sees that it's
clear. It then ends up trusting the pagecache to satisfy a read when it
shouldn't.

Fix this by adding a bitlock to ensure that the clearing of the flag is
atomic with respect to the actual cache invalidation. Also, move the
other existing users of cifs_invalidate_mapping to use a new
cifs_zap_mapping() function that just sets the INVALID_MAPPING bit and
then uses the standard codepath to handle the invalidation.

Signed-off-by: Jeff Layton <jlayton@poochiereds.net>
Signed-off-by: Steve French <smfrench@gmail.com>

1 files changed, 41 insertions, 9 deletions

diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index ff420b275777..9ff8df8b4d84 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -22,6 +22,7 @@
 #include <linux/stat.h>
 #include <linux/slab.h>
 #include <linux/pagemap.h>
+#include <linux/freezer.h>
 #include <asm/div64.h>
 #include "cifsfs.h"
 #include "cifspdu.h"
@@ -1762,29 +1763,60 @@ int
 cifs_invalidate_mapping(struct inode *inode)
 {
         int rc = 0;
-        struct cifsInodeInfo *cifs_i = CIFS_I(inode);
-
-        clear_bit(CIFS_INO_INVALID_MAPPING, &cifs_i->flags);
 
         if (inode->i_mapping && inode->i_mapping->nrpages != 0) {
                 rc = invalidate_inode_pages2(inode->i_mapping);
-                if (rc) {
+                if (rc)
                         cifs_dbg(VFS, "%s: could not invalidate inode %p\n",
                                  __func__, inode);
-                        set_bit(CIFS_INO_INVALID_MAPPING, &cifs_i->flags);
-                }
         }
 
         cifs_fscache_reset_inode_cookie(inode);
         return rc;
 }
 
+/**
+ * cifs_wait_bit_killable - helper for functions that are sleeping on bit locks
+ * @word: long word containing the bit lock
+ */
+static int
+cifs_wait_bit_killable(void *word)
+{
+        if (fatal_signal_pending(current))
+                return -ERESTARTSYS;
+        freezable_schedule_unsafe();
+        return 0;
+}
+
 int
 cifs_revalidate_mapping(struct inode *inode)
 {
-        if (test_bit(CIFS_INO_INVALID_MAPPING, &CIFS_I(inode)->flags))
-                return cifs_invalidate_mapping(inode);
-        return 0;
+        int rc;
+        unsigned long *flags = &CIFS_I(inode)->flags;
+
+        rc = wait_on_bit_lock(flags, CIFS_INO_LOCK, cifs_wait_bit_killable,
+                                TASK_KILLABLE);
+        if (rc)
+                return rc;
+
+        if (test_and_clear_bit(CIFS_INO_INVALID_MAPPING, flags)) {
+                rc = cifs_invalidate_mapping(inode);
+                if (rc)
+                        set_bit(CIFS_INO_INVALID_MAPPING, flags);
+        }
+
+        clear_bit_unlock(CIFS_INO_LOCK, flags);
+        smp_mb__after_clear_bit();
+        wake_up_bit(flags, CIFS_INO_LOCK);
+
+        return rc;
+}
+
+int
+cifs_zap_mapping(struct inode *inode)
+{
+        set_bit(CIFS_INO_INVALID_MAPPING, &CIFS_I(inode)->flags);
+        return cifs_revalidate_mapping(inode);
 }
 
 int cifs_revalidate_file_attr(struct file *filp)