Al Viro 22213318af fix races between __d_instantiate() and checks of dentry flags
in non-lazy walk we need to be careful about dentry switching from
negative to positive - both ->d_flags and ->d_inode are updated,
and in some places we might see only one store.  The cases where
dentry has been obtained by dcache lookup with ->i_mutex held on
parent are safe - ->d_lock and ->i_mutex provide all the barriers
we need.  However, there are several places where we run into
trouble:
	* do_last() fetches ->d_inode, then checks ->d_flags and
assumes that inode won't be NULL unless d_is_negative() is true.
Race with e.g. creat() - we might have fetched the old value of
->d_inode (still NULL) and new value of ->d_flags (already not
DCACHE_MISS_TYPE).  Lin Ming has observed and reported the resulting
oops.
	* a bunch of places checks ->d_inode for being non-NULL,
then checks ->d_flags for "is it a symlink".  Race with symlink(2)
in case if our CPU sees ->d_inode update first - we see non-NULL
there, but ->d_flags still contains DCACHE_MISS_TYPE instead of
DCACHE_SYMLINK_TYPE.  Result: false negative on "should we follow
link here?", with subsequent unpleasantness.

Cc: stable@vger.kernel.org # 3.13 and 3.14 need that one
Reported-and-tested-by: Lin Ming <minggr@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-04-19 12:30:58 -04:00
..
2014-04-12 15:39:53 -07:00
2013-12-04 12:27:46 +01:00
2014-04-07 10:17:30 -07:00
2014-01-25 03:14:05 -05:00
2013-12-05 16:36:21 -06:00
2014-04-04 15:50:08 -07:00
2013-11-09 00:16:20 -05:00
2014-02-07 16:08:57 -08:00
2014-02-07 16:08:57 -08:00
2014-04-01 23:19:09 -04:00
2013-11-23 22:33:47 -08:00
2014-04-01 23:19:08 -04:00
2014-04-01 23:19:08 -04:00
2014-04-01 23:19:09 -04:00
2013-11-09 00:16:31 -05:00