2003-05-14 21:28:33

by Mikhail Kruk

[permalink] [raw]
Subject: possible open/unlink race condition?

I'm seeing a possible race condition on 2.4.18. It seems that the
following scenario is possible:

process 1 process 2

open(filename, O_CREATE)
start creating file
put an entry into the directory cache

<CONTEXT SWITCH>
opendir()
readdir() // returns "filename"
unlink(filename) // success
access(filename) // it's gone

<CONTEXTSWITCH>
write the directory update on disk
result: file is resurrected but process 2 thinks it deleted it

-----------------------

The description of file creation in the process 1 is completely made up, I
don't really know how it works and I'm only starting to look at the
kernel, but I just would like to know if something like this is at all
possible. I.e. is it possible that process 1 creates file, process 2
sees that file in a directory and unlinks it, and then process 1 does
something inside the same open call, which resurrects the file?

It really looks like this is happening (very rarely) in an
application I'm debugging.

please cc me, I'm not on the list


2003-05-14 22:11:02

by Al Viro

[permalink] [raw]
Subject: Re: possible open/unlink race condition?

On Wed, May 14, 2003 at 05:41:23PM -0400, Mikhail Kruk wrote:

> The description of file creation in the process 1 is completely made up, I

So it is. ->i_sem is held on parent directory both for creation and
removal.