[XFS] Really fix use after free in xfs_iunpin.

The previous attempts to fix the linux inode use-after-free in xfs_iunpin
simply made the problem harder to hit. We actually need complete exclusion
between xfs_reclaim and xfs_iunpin, as well as ensuring that the i_flags
are consistent during both of these functions. Introduce a new spinlock
for exclusion and the i_flags, and fix up xfs_iunpin to use igrab before
marking the inode dirty.

SGI-PV: 952967
SGI-Modid: xfs-linux-melb:xfs-kern:26964a

Signed-off-by: David Chinner <dgc@sgi.com>
Signed-off-by: Tim Shimmin <tes@sgi.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 1a6782eaf5d4..061e2ffdd1de 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -3844,7 +3844,9 @@ xfs_reclaim(
                 XFS_MOUNT_ILOCK(mp);
                 vn_bhv_remove(VN_BHV_HEAD(vp), XFS_ITOBHV(ip));
                 list_add_tail(&ip->i_reclaim, &mp->m_del_inodes);
+                spin_lock(&ip->i_flags_lock);
                 ip->i_flags |= XFS_IRECLAIMABLE;
+                spin_unlock(&ip->i_flags_lock);
                 XFS_MOUNT_IUNLOCK(mp);
         }
         return 0;
@@ -3869,8 +3871,10 @@ xfs_finish_reclaim(
          * us.
          */
         write_lock(&ih->ih_lock);
+        spin_lock(&ip->i_flags_lock);
         if ((ip->i_flags & XFS_IRECLAIM) ||
             (!(ip->i_flags & XFS_IRECLAIMABLE) && vp == NULL)) {
+                spin_unlock(&ip->i_flags_lock);
                 write_unlock(&ih->ih_lock);
                 if (locked) {
                         xfs_ifunlock(ip);
@@ -3879,6 +3883,7 @@ xfs_finish_reclaim(
                 return 1;
         }
         ip->i_flags |= XFS_IRECLAIM;
+        spin_unlock(&ip->i_flags_lock);
         write_unlock(&ih->ih_lock);
 
         /*