Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754152AbbEEBot (ORCPT ); Mon, 4 May 2015 21:44:49 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:50803 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752401AbbEEBWb (ORCPT ); Mon, 4 May 2015 21:22:31 -0400 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Al Viro" Date: Tue, 05 May 2015 02:16:39 +0100 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.2 058/221] debugfs: leave freeing a symlink body until inode eviction In-Reply-To: X-SA-Exim-Connect-IP: 192.168.4.249 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2696 Lines: 94 3.2.69-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Al Viro commit 0db59e59299f0b67450c5db21f7f316c8fb04e84 upstream. As it is, we have debugfs_remove() racing with symlink traversals. Supply ->evict_inode() and do freeing there - inode will remain pinned until we are done with the symlink body. And rip the idiocy with checking if dentry is positive right after we'd verified debugfs_positive(), which is a stronger check... Signed-off-by: Al Viro [bwh: Backported to 3.2: - Plumb in debugfs_super_operations, which we didn't previously define - Call truncate_inode_pages() instead of truncate_inode_pages_final() - Call end_writeback() instead of clear_inode()] Signed-off-by: Ben Hutchings --- --- a/fs/debugfs/inode.c +++ b/fs/debugfs/inode.c @@ -125,11 +125,30 @@ static inline int debugfs_positive(struc return dentry->d_inode && !d_unhashed(dentry); } +static void debugfs_evict_inode(struct inode *inode) +{ + truncate_inode_pages(&inode->i_data, 0); + end_writeback(inode); + if (S_ISLNK(inode->i_mode)) + kfree(inode->i_private); +} + +static const struct super_operations debugfs_super_operations = { + .evict_inode = debugfs_evict_inode, +}; + static int debug_fill_super(struct super_block *sb, void *data, int silent) { static struct tree_descr debug_files[] = {{""}}; + int err; + + err = simple_fill_super(sb, DEBUGFS_MAGIC, debug_files); + if (err) + return err; - return simple_fill_super(sb, DEBUGFS_MAGIC, debug_files); + sb->s_op = &debugfs_super_operations; + + return 0; } static struct dentry *debug_mount(struct file_system_type *fs_type, @@ -312,23 +331,14 @@ static int __debugfs_remove(struct dentr int ret = 0; if (debugfs_positive(dentry)) { - if (dentry->d_inode) { - dget(dentry); - switch (dentry->d_inode->i_mode & S_IFMT) { - case S_IFDIR: - ret = simple_rmdir(parent->d_inode, dentry); - break; - case S_IFLNK: - kfree(dentry->d_inode->i_private); - /* fall through */ - default: - simple_unlink(parent->d_inode, dentry); - break; - } - if (!ret) - d_delete(dentry); - dput(dentry); - } + dget(dentry); + if (S_ISDIR(dentry->d_inode->i_mode)) + ret = simple_rmdir(parent->d_inode, dentry); + else + simple_unlink(parent->d_inode, dentry); + if (!ret) + d_delete(dentry); + dput(dentry); } return ret; } -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/