diff options
author | J. Bruce Fields <bfields@redhat.com> | 2014-02-17 17:45:56 -0500 |
---|---|---|
committer | Al Viro <viro@zeniv.linux.org.uk> | 2014-08-07 14:40:10 -0400 |
commit | 75a2352d0110960aeee1a28ddc09a55f97c99100 (patch) | |
tree | 09df0569f40eb0a50a752575fa7991c62b98a76b /fs/dcache.c | |
parent | 3f70bd51cb4405dc5cf8624292ffa474679fc9c7 (diff) |
dcache: close d_move race in d_splice_alias
d_splice_alias will d_move an IS_ROOT() directory dentry into place if
one exists. This should be safe as long as the dentry remains IS_ROOT,
but I can't see what guarantees that: once we drop the i_lock all we
hold here is the i_mutex on an unrelated parent directory.
Instead copy the logic of d_materialise_unique.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs/dcache.c')
-rw-r--r-- | fs/dcache.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/fs/dcache.c b/fs/dcache.c index 8bdae36a095f..8c09db9bb2a4 100644 --- a/fs/dcache.c +++ b/fs/dcache.c | |||
@@ -2676,9 +2676,14 @@ struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry) | |||
2676 | new = __d_find_alias(inode, 1); | 2676 | new = __d_find_alias(inode, 1); |
2677 | if (new) { | 2677 | if (new) { |
2678 | BUG_ON(!(new->d_flags & DCACHE_DISCONNECTED)); | 2678 | BUG_ON(!(new->d_flags & DCACHE_DISCONNECTED)); |
2679 | write_seqlock(&rename_lock); | ||
2680 | __d_materialise_dentry(dentry, new); | ||
2681 | write_sequnlock(&rename_lock); | ||
2682 | __d_drop(new); | ||
2683 | _d_rehash(new); | ||
2684 | spin_unlock(&new->d_lock); | ||
2679 | spin_unlock(&inode->i_lock); | 2685 | spin_unlock(&inode->i_lock); |
2680 | security_d_instantiate(new, inode); | 2686 | security_d_instantiate(new, inode); |
2681 | d_move(new, dentry); | ||
2682 | iput(inode); | 2687 | iput(inode); |
2683 | } else { | 2688 | } else { |
2684 | /* already taking inode->i_lock, so d_add() by hand */ | 2689 | /* already taking inode->i_lock, so d_add() by hand */ |