• Linus Torvalds's avatar
    vfs: fix dentry RCU to refcounting possibly sleeping dput() · e5c832d5
    Linus Torvalds authored
    This is the fix that the last two commits indirectly led up to - making
    sure that we don't call dput() in a bad context on the dentries we've
    looked up in RCU mode after the sequence count validation fails.
    
    This basically expands d_rcu_to_refcount() into the callers, and then
    fixes the callers to delay the dput() in the failure case until _after_
    we've dropped all locks and are no longer in an RCU-locked region.
    
    The case of 'complete_walk()' was trivial, since its failure case did
    the unlock_rcu_walk() directly after the call to d_rcu_to_refcount(),
    and as such that is just a pure expansion of the function with a trivial
    movement of the resulting dput() to after 'unlock_rcu_walk()'.
    
    In contrast, the unlazy_walk() case was much more complicated, because
    not only does convert two different dentries from RCU to be reference
    counted, but it used to not call unlock_rcu_walk() at all, and instead
    just returned an error and let the caller clean everything up in
    "terminate_walk()".
    
    Happily, one of the dentries in question (called "parent" inside
    unlazy_walk()) is the dentry of "nd->path", which terminate_walk() wants
    a refcount to anyway for the non-RCU case.
    
    So what the new and improved unlazy_walk() does is to first turn that
    dentry into a refcounted one, and once that is set up, the error cases
    can continue to use the terminate_walk() helper for cleanup, but for the
    non-RCU case.  Which makes it possible to drop out of RCU mode if we
    actually hit the sequence number failure case.
    Acked-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    e5c832d5
namei.c 107 KB