Commit 2130781e authored by Cesar Eduardo Barros's avatar Cesar Eduardo Barros Committed by Linus Torvalds

sys_swapon: fix inode locking

A conflict between 52c50567 ("mm: swap: unlock swapfile inode mutex
before closing file on bad swapfiles") and 83ef99be ("sys_swapon:
remove did_down variable") caused a double unlock of the inode mutex
(once in bad_swap: before the filp_close, once at the end just before
returning).

The patch which added the extra unlock cleared did_down to avoid
unlocking twice, but the other patch removed the did_down variable.

To fix, set inode to NULL after the first unlock, since it will be used
after that point only for the final unlock.

While checking this patch, I found a path which could unlock without
locking, in case the same inode was added as a swapfile twice. To fix,
move the setting of the inode variable further down, to just before
claim_swapfile, which will lock the inode before doing anything else.

Cc: Mel Gorman <mgorman@suse.de>
Cc: Hugh Dickins <hughd@google.com>
Cc: Eric B Munson <emunson@mgebm.net>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarCesar Eduardo Barros <cesarb@cesarb.net>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 04948c7f
...@@ -2088,7 +2088,6 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags) ...@@ -2088,7 +2088,6 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
p->swap_file = swap_file; p->swap_file = swap_file;
mapping = swap_file->f_mapping; mapping = swap_file->f_mapping;
inode = mapping->host;
for (i = 0; i < nr_swapfiles; i++) { for (i = 0; i < nr_swapfiles; i++) {
struct swap_info_struct *q = swap_info[i]; struct swap_info_struct *q = swap_info[i];
...@@ -2101,6 +2100,8 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags) ...@@ -2101,6 +2100,8 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
} }
} }
inode = mapping->host;
/* If S_ISREG(inode->i_mode) will do mutex_lock(&inode->i_mutex); */
error = claim_swapfile(p, inode); error = claim_swapfile(p, inode);
if (unlikely(error)) if (unlikely(error))
goto bad_swap; goto bad_swap;
...@@ -2187,8 +2188,10 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags) ...@@ -2187,8 +2188,10 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
spin_unlock(&swap_lock); spin_unlock(&swap_lock);
vfree(swap_map); vfree(swap_map);
if (swap_file) { if (swap_file) {
if (inode && S_ISREG(inode->i_mode)) if (inode && S_ISREG(inode->i_mode)) {
mutex_unlock(&inode->i_mutex); mutex_unlock(&inode->i_mutex);
inode = NULL;
}
filp_close(swap_file, NULL); filp_close(swap_file, NULL);
} }
out: out:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment