Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Message-ID: <894091e9742896e4bc810458a9f71f3f59a48860.camel@themaw.net>
Subject: Re: [PATCH v3 00/24] Convert vfs.txt to vfs.rst
From:   Ian Kent <raven@themaw.net>
To:     NeilBrown <neilb@suse.com>, Al Viro <viro@zeniv.linux.org.uk>,
        Jonathan Corbet <corbet@lwn.net>
Cc:     "Tobin C. Harding" <tobin@kernel.org>,
        Mauro Carvalho Chehab <mchehab@s-opensource.com>,
        Randy Dunlap <rdunlap@infradead.org>,
        linux-doc@vger.kernel.org, linux-fsdevel@vger.kernel.org,
        linux-kernel@vger.kernel.org
Date:   Thu, 04 Apr 2019 07:28:52 +0800
In-Reply-To: <87ftqz29i2.fsf@notabene.neil.brown.name>
References: <20190327051717.23225-1-tobin@kernel.org>
         <20190402094934.5b242dc0@lwn.net>
         <20190402164824.GK2217@ZenIV.linux.org.uk>
         <20190402175401.GL2217@ZenIV.linux.org.uk>
         <20190402190811.GM2217@ZenIV.linux.org.uk>
         <5c5e02f8b8add4aa2fc24ba2a0880652529588af.camel@themaw.net>
         <87ftqz29i2.fsf@notabene.neil.brown.name>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Wed, 2019-04-03 at 11:55 +1100, NeilBrown wrote:
> On Wed, Apr 03 2019, Ian Kent wrote:
> 
> > On Tue, 2019-04-02 at 20:08 +0100, Al Viro wrote:
> > > On Tue, Apr 02, 2019 at 06:54:01PM +0100, Al Viro wrote:
> > > > static void autofs_dentry_release(struct dentry *de)
> > > > {
> > > >         struct autofs_info *ino = autofs_dentry_ino(de);
> > > >         struct autofs_sb_info *sbi = autofs_sbi(de->d_sb);
> > > > 
> > > >         pr_debug("releasing %p\n", de);
> > > > 
> > > >         if (!ino)
> > > >                 return;
> > > > ...
> > > >         autofs_free_ino(ino);
> > > > }
> > > > with autofs_free_ino() being straight kfree().  Which means
> > > > that the lockless case of autofs_d_manage() can run into
> > > > autofs_dentry_ino(dentry) getting freed right under it.
> > > > 
> > > > And there we do have this reachable:
> > > > int autofs_expire_wait(const struct path *path, int rcu_walk)
> > > > {
> > > >         struct dentry *dentry = path->dentry;
> > > >         struct autofs_sb_info *sbi = autofs_sbi(dentry->d_sb);
> > > >         struct autofs_info *ino = autofs_dentry_ino(dentry);
> > > >         int status;
> > > >         int state;
> > > > 
> > > >         /* Block on any pending expire */
> > > >         if (!(ino->flags & AUTOFS_INF_WANT_EXPIRE))
> > 
> > Oh yes, this is saying the dentry hasn't been selected
> > for expire on the first pass, there's a second pass at
> > expire selection so there's a delay there and both flags
> > (this one and the expiring flag) are kept throughout the
> > expire operation if dentry is selected.
> > 
> > That might be partly why an oops has never been seen but
> > path walks can occur at any time so it's a bit puzzling.
> > 
> > LOL, and Neil probably can't remember the deeper detail
> > on what he did there now either.
> 
> It seems very likely that this was just a subtlety that I missed.
> I doesn't help that "ino" isn't actually and inode and isn't freed like
> an inode, but that is no excuse.

I've become accustom to the naming so that doesn't occur to
me, ;)

> 
> When we add the rcu_head linkage to 'struct autofs_info', we might as
> well remove the 'struct inode' from there - it doesn't seem to have been
> used for years.

That's a good point, I've thought about doing so several
times but haven't got around to it.

Ian