Commit 290a768a authored by Anton Altaparmakov's avatar Anton Altaparmakov

NTFS: 2.1.14 - Fix an NFSd caused deadlock reported by several users.

- Modify fs/ntfs/ntfs_readdir() to copy the index root attribute value
  to a buffer so that we can put the search context and unmap the mft
  record before calling the filldir() callback.  We need to do this
  because of NFSd which calls ->lookup() from its filldir callback()
  and this causes NTFS to deadlock as ntfs_lookup() maps the mft record
  of the directory and since ntfs_readdir() has got it mapped already
  ntfs_lookup() deadlocks.
Signed-off-by: default avatarAnton Altaparmakov <aia21@cantab.net>
parent 62eed986
......@@ -273,6 +273,8 @@ ChangeLog
Note, a technical ChangeLog aimed at kernel hackers is in fs/ntfs/ChangeLog.
2.1.14:
- Fix an NFSd caused deadlock reported by several users.
2.1.13:
- Implement writing of inodes (access time updates are not implemented
yet so mounting with -o noatime,nodiratime is enforced).
......
......@@ -35,6 +35,16 @@ ToDo/Notes:
- Enable the code for setting the NT4 compatibility flag when we start
making NTFS 1.2 specific modifications.
2.1.14 - Fix an NFSd caused deadlock reported by several users.
- Modify fs/ntfs/ntfs_readdir() to copy the index root attribute value
to a buffer so that we can put the search context and unmap the mft
record before calling the filldir() callback. We need to do this
because of NFSd which calls ->lookup() from its filldir callback()
and this causes NTFS to deadlock as ntfs_lookup() maps the mft record
of the directory and since ntfs_readdir() has got it mapped already
ntfs_lookup() deadlocks.
2.1.13 - Enable overwriting of resident files and housekeeping of system files.
- Implement writing of mft records (fs/ntfs/mft.[hc]), which includes
......
......@@ -5,7 +5,7 @@ obj-$(CONFIG_NTFS_FS) += ntfs.o
ntfs-objs := aops.o attrib.o compress.o debug.o dir.o file.o inode.o mft.o \
mst.o namei.o super.o sysctl.o unistr.o upcase.o
EXTRA_CFLAGS = -DNTFS_VERSION=\"2.1.13\"
EXTRA_CFLAGS = -DNTFS_VERSION=\"2.1.14\"
ifeq ($(CONFIG_NTFS_DEBUG),y)
EXTRA_CFLAGS += -DDEBUG
......
......@@ -1067,7 +1067,7 @@ static int ntfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
ntfs_inode *ndir = NTFS_I(vdir);
ntfs_volume *vol = NTFS_SB(sb);
MFT_RECORD *m;
INDEX_ROOT *ir;
INDEX_ROOT *ir = NULL;
INDEX_ENTRY *ie;
INDEX_ALLOCATION *ia;
u8 *name = NULL;
......@@ -1139,9 +1139,29 @@ static int ntfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
"inode 0x%lx.", vdir->i_ino);
goto err_out;
}
/* Get to the index root value (it's been verified in read_inode). */
ir = (INDEX_ROOT*)((u8*)ctx->attr +
le16_to_cpu(ctx->attr->data.resident.value_offset));
/*
* Copy the index root attribute value to a buffer so that we can put
* the search context and unmap the mft record before calling the
* filldir() callback. We need to do this because of NFSd which calls
* ->lookup() from its filldir callback() and this causes NTFS to
* deadlock as ntfs_lookup() maps the mft record of the directory and
* we have got it mapped here already. The only solution is for us to
* unmap the mft record here so that a call to ntfs_lookup() is able to
* map the mft record without deadlocking.
*/
rc = le32_to_cpu(ctx->attr->data.resident.value_length);
ir = (INDEX_ROOT*)kmalloc(rc, GFP_NOFS);
if (unlikely(!ir)) {
err = -ENOMEM;
goto err_out;
}
/* Copy the index root value (it has been verified in read_inode). */
memcpy(ir, (u8*)ctx->attr +
le16_to_cpu(ctx->attr->data.resident.value_offset), rc);
put_attr_search_ctx(ctx);
unmap_mft_record(ndir);
ctx = NULL;
m = NULL;
index_end = (u8*)&ir->index + le32_to_cpu(ir->index.index_length);
/* The first index entry. */
ie = (INDEX_ENTRY*)((u8*)&ir->index +
......@@ -1154,7 +1174,7 @@ static int ntfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
for (;; ie = (INDEX_ENTRY*)((u8*)ie + le16_to_cpu(ie->length))) {
ntfs_debug("In index root, offset 0x%x.", (u8*)ie - (u8*)ir);
/* Bounds checks. */
if (unlikely((u8*)ie < (u8*)ctx->mrec || (u8*)ie +
if (unlikely((u8*)ie < (u8*)ir || (u8*)ie +
sizeof(INDEX_ENTRY_HEADER) > index_end ||
(u8*)ie + le16_to_cpu(ie->key_length) >
index_end))
......@@ -1169,20 +1189,13 @@ static int ntfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
rc = ntfs_filldir(vol, &fpos, ndir, INDEX_TYPE_ROOT, ir, ie,
name, dirent, filldir);
if (rc) {
put_attr_search_ctx(ctx);
unmap_mft_record(ndir);
kfree(ir);
goto abort;
}
}
/*
* We are done with the index root and the mft record for that matter.
* We need to release it, otherwise we deadlock on ntfs_attr_iget()
* and/or ntfs_read_page().
*/
put_attr_search_ctx(ctx);
unmap_mft_record(ndir);
m = NULL;
ctx = NULL;
/* We are done with the index root and can free the buffer. */
kfree(ir);
ir = NULL;
/* If there is no index allocation attribute we are finished. */
if (!NInoIndexAllocPresent(ndir))
goto EOD;
......@@ -1379,6 +1392,8 @@ static int ntfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
ntfs_unmap_page(bmp_page);
if (ia_page)
ntfs_unmap_page(ia_page);
if (ir)
kfree(ir);
if (name)
kfree(name);
if (ctx)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment