[XFS] Really fix use after free in xfs_iunpin.

The previous attempts to fix the linux inode use-after-free in xfs_iunpin
simply made the problem harder to hit. We actually need complete exclusion
between xfs_reclaim and xfs_iunpin, as well as ensuring that the i_flags
are consistent during both of these functions. Introduce a new spinlock
for exclusion and the i_flags, and fix up xfs_iunpin to use igrab before
marking the inode dirty.

SGI-PV: 952967
SGI-Modid: xfs-linux-melb:xfs-kern:26964a

Signed-off-by: David Chinner <dgc@sgi.com>
Signed-off-by: Tim Shimmin <tes@sgi.com>

1 files changed, 20 insertions, 3 deletions

diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 66a78287a957..c27d7d495aa0 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -867,6 +867,7 @@ xfs_iread(
         ip = kmem_zone_zalloc(xfs_inode_zone, KM_SLEEP);
         ip->i_ino = ino;
         ip->i_mount = mp;
+        spin_lock_init(&ip->i_flags_lock);
 
         /*
          * Get pointer's to the on-disk inode and the buffer containing it.
@@ -2214,7 +2215,9 @@ xfs_ifree_cluster(
 
                         if (ip == free_ip) {
                                 if (xfs_iflock_nowait(ip)) {
+                                        spin_lock(&ip->i_flags_lock);
                                         ip->i_flags |= XFS_ISTALE;
+                                        spin_unlock(&ip->i_flags_lock);
 
                                         if (xfs_inode_clean(ip)) {
                                                 xfs_ifunlock(ip);
@@ -2228,7 +2231,9 @@ xfs_ifree_cluster(
 
                         if (xfs_ilock_nowait(ip, XFS_ILOCK_EXCL)) {
                                 if (xfs_iflock_nowait(ip)) {
+                                        spin_lock(&ip->i_flags_lock);
                                         ip->i_flags |= XFS_ISTALE;
+                                        spin_unlock(&ip->i_flags_lock);
 
                                         if (xfs_inode_clean(ip)) {
                                                 xfs_ifunlock(ip);
@@ -2258,7 +2263,9 @@ xfs_ifree_cluster(
                                 AIL_LOCK(mp,s);
                                 iip->ili_flush_lsn = iip->ili_item.li_lsn;
                                 AIL_UNLOCK(mp, s);
+                                spin_lock(&iip->ili_inode->i_flags_lock);
                                 iip->ili_inode->i_flags |= XFS_ISTALE;
+                                spin_unlock(&iip->ili_inode->i_flags_lock);
                                 pre_flushed++;
                         }
                         lip = lip->li_bio_list;
@@ -2754,19 +2761,29 @@ xfs_iunpin(
                  * call as the inode reclaim may be blocked waiting for
                  * the inode to become unpinned.
                  */
+                struct inode *inode = NULL;
+
+                spin_lock(&ip->i_flags_lock);
                 if (!(ip->i_flags & (XFS_IRECLAIM|XFS_IRECLAIMABLE))) {
                         bhv_vnode_t     *vp = XFS_ITOV_NULL(ip);
 
                         /* make sync come back and flush this inode */
                         if (vp) {
-                                struct inode    *inode = vn_to_inode(vp);
+                                inode = vn_to_inode(vp);
 
                                 if (!(inode->i_state &
-                                                (I_NEW|I_FREEING|I_CLEAR)))
-                                        mark_inode_dirty_sync(inode);
+                                                (I_NEW|I_FREEING|I_CLEAR))) {
+                                        inode = igrab(inode);
+                                        if (inode)
+                                                mark_inode_dirty_sync(inode);
+                                } else
+                                        inode = NULL;
                         }
                 }
+                spin_unlock(&ip->i_flags_lock);
                 wake_up(&ip->i_ipin_wait);
+                if (inode)
+                        iput(inode);
         }
 }