Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNeilBrown <neilb@suse.com>2018-11-01 13:54:23 +1100
committerNeilBrown <neilb@suse.com>2018-11-01 13:54:23 +1100
commit0e081e59cda20b8639181a0734700985fa8df1ee (patch)
tree8c360c05898b6eacdb92807dc9868f1859c08f5d
parent8d3e28cbe4f9398036c1c1c688b0ecc1c20a30b0 (diff)
- do d_instantiate/unlock_new_inode combinations safely
(git-fixes). - Delete patches.fixes/f2fs-call-unlock_new_inode-before-d_instantiate.patch. These two patch both change the same code - the former is more complete.
-rw-r--r--patches.fixes/do-d_instantiate-unlock_new_inode-combinations-safel.patch457
-rw-r--r--patches.fixes/f2fs-call-unlock_new_inode-before-d_instantiate.patch77
-rw-r--r--series.conf2
3 files changed, 458 insertions, 78 deletions
diff --git a/patches.fixes/do-d_instantiate-unlock_new_inode-combinations-safel.patch b/patches.fixes/do-d_instantiate-unlock_new_inode-combinations-safel.patch
new file mode 100644
index 0000000000..693501049a
--- /dev/null
+++ b/patches.fixes/do-d_instantiate-unlock_new_inode-combinations-safel.patch
@@ -0,0 +1,457 @@
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 4 May 2018 08:23:01 -0400
+Subject: [PATCH] do d_instantiate/unlock_new_inode combinations safely
+Git-commit: 1e2e547a93a00ebc21582c06ca3c6cfea2a309ee
+Patch-mainline: v4.17
+References: git-fixes
+
+For anything NFS-exported we do _not_ want to unlock new inode
+before it has grown an alias; original set of fixes got the
+ordering right, but missed the nasty complication in case of
+lockdep being enabled - unlock_new_inode() does
+ lockdep_annotate_inode_mutex_key(inode)
+which can only be done before anyone gets a chance to touch
+->i_mutex. Unfortunately, flipping the order and doing
+unlock_new_inode() before d_instantiate() opens a window when
+mkdir can race with open-by-fhandle on a guessed fhandle, leading
+to multiple aliases for a directory inode and all the breakage
+that follows from that.
+
+ Correct solution: a new primitive (d_instantiate_new())
+combining these two in the right order - lockdep annotate, then
+d_instantiate(), then the rest of unlock_new_inode(). All
+combinations of d_instantiate() with unlock_new_inode() should
+be converted to that.
+
+Cc: stable@kernel.org # 2.6.29 and later
+Tested-by: Mike Marshall <hubcap@omnibond.com>
+Reviewed-by: Andreas Dilger <adilger@dilger.ca>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Acked-by: NeilBrown <neilb@suse.com>
+
+---
+ fs/btrfs/inode.c | 16 ++++------------
+ fs/dcache.c | 22 ++++++++++++++++++++++
+ fs/ecryptfs/inode.c | 3 +--
+ fs/ext2/namei.c | 6 ++----
+ fs/ext4/namei.c | 6 ++----
+ fs/f2fs/namei.c | 12 ++++--------
+ fs/jffs2/dir.c | 12 ++++--------
+ fs/jfs/namei.c | 12 ++++--------
+ fs/nilfs2/namei.c | 6 ++----
+ fs/orangefs/namei.c | 9 +++------
+ fs/reiserfs/namei.c | 12 ++++--------
+ fs/udf/namei.c | 6 ++----
+ fs/ufs/namei.c | 6 ++----
+ include/linux/dcache.h | 1 +
+ 14 files changed, 57 insertions(+), 72 deletions(-)
+
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -6574,8 +6574,7 @@ static int btrfs_mknod(struct inode *dir
+ goto out_unlock_inode;
+ } else {
+ btrfs_update_inode(trans, root, inode);
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ }
+
+ out_unlock:
+@@ -6652,8 +6651,7 @@ static int btrfs_create(struct inode *di
+ goto out_unlock_inode;
+
+ BTRFS_I(inode)->io_tree.ops = &btrfs_extent_io_ops;
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+
+ out_unlock:
+ btrfs_end_transaction(trans);
+@@ -6800,12 +6798,7 @@ static int btrfs_mkdir(struct inode *dir
+ if (err)
+ goto out_fail_inode;
+
+- d_instantiate(dentry, inode);
+- /*
+- * mkdir is special. We're unlocking after we call d_instantiate
+- * to avoid a race with nfsd calling d_instantiate.
+- */
+- unlock_new_inode(inode);
++ d_instantiate_new(dentry, inode);
+ drop_on_err = 0;
+
+ out_fail:
+@@ -10467,8 +10460,7 @@ static int btrfs_symlink(struct inode *d
+ goto out_unlock_inode;
+ }
+
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+
+ out_unlock:
+ btrfs_end_transaction(trans);
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1863,6 +1863,28 @@ void d_instantiate(struct dentry *entry,
+ }
+ EXPORT_SYMBOL(d_instantiate);
+
++/*
++ * This should be equivalent to d_instantiate() + unlock_new_inode(),
++ * with lockdep-related part of unlock_new_inode() done before
++ * anything else. Use that instead of open-coding d_instantiate()/
++ * unlock_new_inode() combinations.
++ */
++void d_instantiate_new(struct dentry *entry, struct inode *inode)
++{
++ BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
++ BUG_ON(!inode);
++ lockdep_annotate_inode_mutex_key(inode);
++ security_d_instantiate(entry, inode);
++ spin_lock(&inode->i_lock);
++ __d_instantiate(entry, inode);
++ WARN_ON(!(inode->i_state & I_NEW));
++ inode->i_state &= ~I_NEW;
++ smp_mb();
++ wake_up_bit(&inode->i_state, __I_NEW);
++ spin_unlock(&inode->i_lock);
++}
++EXPORT_SYMBOL(d_instantiate_new);
++
+ /**
+ * d_instantiate_no_diralias - instantiate a non-aliased dentry
+ * @entry: dentry to complete
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -283,8 +283,7 @@ ecryptfs_create(struct inode *directory_
+ iget_failed(ecryptfs_inode);
+ goto out;
+ }
+- unlock_new_inode(ecryptfs_inode);
+- d_instantiate(ecryptfs_dentry, ecryptfs_inode);
++ d_instantiate_new(ecryptfs_dentry, ecryptfs_inode);
+ out:
+ return rc;
+ }
+--- a/fs/ext2/namei.c
++++ b/fs/ext2/namei.c
+@@ -40,8 +40,7 @@ static inline int ext2_add_nondir(struct
+ {
+ int err = ext2_add_link(dentry, inode);
+ if (!err) {
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ return 0;
+ }
+ inode_dec_link_count(inode);
+@@ -254,8 +253,7 @@ static int ext2_mkdir(struct inode * dir
+ if (err)
+ goto out_fail;
+
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ out:
+ return err;
+
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -2385,8 +2385,7 @@ static int ext4_add_nondir(handle_t *han
+ int err = ext4_add_entry(handle, dentry, inode);
+ if (!err) {
+ ext4_mark_inode_dirty(handle, inode);
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ return 0;
+ }
+ drop_nlink(inode);
+@@ -2625,8 +2624,7 @@ out_clear_inode:
+ err = ext4_mark_inode_dirty(handle, dir);
+ if (err)
+ goto out_clear_inode;
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ if (IS_DIRSYNC(dir))
+ ext4_handle_sync(handle);
+
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -156,8 +156,7 @@ static int f2fs_create(struct inode *dir
+
+ alloc_nid_done(sbi, ino);
+
+- d_instantiate(dentry, inode);
+- unlock_new_inode(inode);
++ d_instantiate_new(dentry, inode);
+
+ if (IS_DIRSYNC(dir))
+ f2fs_sync_fs(sbi->sb, 1);
+@@ -463,8 +462,7 @@ static int f2fs_symlink(struct inode *di
+ err = page_symlink(inode, disk_link.name, disk_link.len);
+
+ err_out:
+- d_instantiate(dentry, inode);
+- unlock_new_inode(inode);
++ d_instantiate_new(dentry, inode);
+
+ /*
+ * Let's flush symlink data in order to avoid broken symlink as much as
+@@ -518,8 +516,7 @@ static int f2fs_mkdir(struct inode *dir,
+
+ alloc_nid_done(sbi, inode->i_ino);
+
+- d_instantiate(dentry, inode);
+- unlock_new_inode(inode);
++ d_instantiate_new(dentry, inode);
+
+ if (IS_DIRSYNC(dir))
+ f2fs_sync_fs(sbi->sb, 1);
+@@ -563,8 +560,7 @@ static int f2fs_mknod(struct inode *dir,
+
+ alloc_nid_done(sbi, inode->i_ino);
+
+- d_instantiate(dentry, inode);
+- unlock_new_inode(inode);
++ d_instantiate_new(dentry, inode);
+
+ if (IS_DIRSYNC(dir))
+ f2fs_sync_fs(sbi->sb, 1);
+--- a/fs/jffs2/dir.c
++++ b/fs/jffs2/dir.c
+@@ -209,8 +209,7 @@ static int jffs2_create(struct inode *di
+ __func__, inode->i_ino, inode->i_mode, inode->i_nlink,
+ f->inocache->pino_nlink, inode->i_mapping->nrpages);
+
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ return 0;
+
+ fail:
+@@ -430,8 +429,7 @@ static int jffs2_symlink (struct inode *
+ mutex_unlock(&dir_f->sem);
+ jffs2_complete_reservation(c);
+
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ return 0;
+
+ fail:
+@@ -575,8 +573,7 @@ static int jffs2_mkdir (struct inode *di
+ mutex_unlock(&dir_f->sem);
+ jffs2_complete_reservation(c);
+
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ return 0;
+
+ fail:
+@@ -747,8 +744,7 @@ static int jffs2_mknod (struct inode *di
+ mutex_unlock(&dir_f->sem);
+ jffs2_complete_reservation(c);
+
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ return 0;
+
+ fail:
+--- a/fs/jfs/namei.c
++++ b/fs/jfs/namei.c
+@@ -178,8 +178,7 @@ static int jfs_create(struct inode *dip,
+ unlock_new_inode(ip);
+ iput(ip);
+ } else {
+- unlock_new_inode(ip);
+- d_instantiate(dentry, ip);
++ d_instantiate_new(dentry, ip);
+ }
+
+ out2:
+@@ -313,8 +312,7 @@ static int jfs_mkdir(struct inode *dip,
+ unlock_new_inode(ip);
+ iput(ip);
+ } else {
+- unlock_new_inode(ip);
+- d_instantiate(dentry, ip);
++ d_instantiate_new(dentry, ip);
+ }
+
+ out2:
+@@ -1059,8 +1057,7 @@ static int jfs_symlink(struct inode *dip
+ unlock_new_inode(ip);
+ iput(ip);
+ } else {
+- unlock_new_inode(ip);
+- d_instantiate(dentry, ip);
++ d_instantiate_new(dentry, ip);
+ }
+
+ out2:
+@@ -1447,8 +1444,7 @@ static int jfs_mknod(struct inode *dir,
+ unlock_new_inode(ip);
+ iput(ip);
+ } else {
+- unlock_new_inode(ip);
+- d_instantiate(dentry, ip);
++ d_instantiate_new(dentry, ip);
+ }
+
+ out1:
+--- a/fs/nilfs2/namei.c
++++ b/fs/nilfs2/namei.c
+@@ -46,8 +46,7 @@ static inline int nilfs_add_nondir(struc
+ int err = nilfs_add_link(dentry, inode);
+
+ if (!err) {
+- d_instantiate(dentry, inode);
+- unlock_new_inode(inode);
++ d_instantiate_new(dentry, inode);
+ return 0;
+ }
+ inode_dec_link_count(inode);
+@@ -243,8 +242,7 @@ static int nilfs_mkdir(struct inode *dir
+ goto out_fail;
+
+ nilfs_mark_inode_dirty(inode);
+- d_instantiate(dentry, inode);
+- unlock_new_inode(inode);
++ d_instantiate_new(dentry, inode);
+ out:
+ if (!err)
+ err = nilfs_transaction_commit(dir->i_sb);
+--- a/fs/orangefs/namei.c
++++ b/fs/orangefs/namei.c
+@@ -70,8 +70,7 @@ static int orangefs_create(struct inode
+ get_khandle_from_ino(inode),
+ dentry);
+
+- d_instantiate(dentry, inode);
+- unlock_new_inode(inode);
++ d_instantiate_new(dentry, inode);
+ orangefs_set_timeout(dentry);
+ ORANGEFS_I(inode)->getattr_time = jiffies - 1;
+ ORANGEFS_I(inode)->getattr_mask = STATX_BASIC_STATS;
+@@ -319,8 +318,7 @@ static int orangefs_symlink(struct inode
+ "Assigned symlink inode new number of %pU\n",
+ get_khandle_from_ino(inode));
+
+- d_instantiate(dentry, inode);
+- unlock_new_inode(inode);
++ d_instantiate_new(dentry, inode);
+ orangefs_set_timeout(dentry);
+ ORANGEFS_I(inode)->getattr_time = jiffies - 1;
+ ORANGEFS_I(inode)->getattr_mask = STATX_BASIC_STATS;
+@@ -384,8 +382,7 @@ static int orangefs_mkdir(struct inode *
+ "Assigned dir inode new number of %pU\n",
+ get_khandle_from_ino(inode));
+
+- d_instantiate(dentry, inode);
+- unlock_new_inode(inode);
++ d_instantiate_new(dentry, inode);
+ orangefs_set_timeout(dentry);
+ ORANGEFS_I(inode)->getattr_time = jiffies - 1;
+ ORANGEFS_I(inode)->getattr_mask = STATX_BASIC_STATS;
+--- a/fs/reiserfs/namei.c
++++ b/fs/reiserfs/namei.c
+@@ -687,8 +687,7 @@ static int reiserfs_create(struct inode
+ reiserfs_update_inode_transaction(inode);
+ reiserfs_update_inode_transaction(dir);
+
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ retval = journal_end(&th);
+
+ out_failed:
+@@ -771,8 +770,7 @@ static int reiserfs_mknod(struct inode *
+ goto out_failed;
+ }
+
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ retval = journal_end(&th);
+
+ out_failed:
+@@ -871,8 +869,7 @@ static int reiserfs_mkdir(struct inode *
+ /* the above add_entry did not update dir's stat data */
+ reiserfs_update_sd(&th, dir);
+
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ retval = journal_end(&th);
+ out_failed:
+ reiserfs_write_unlock(dir->i_sb);
+@@ -1187,8 +1184,7 @@ static int reiserfs_symlink(struct inode
+ goto out_failed;
+ }
+
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ retval = journal_end(&th);
+ out_failed:
+ reiserfs_write_unlock(parent_dir->i_sb);
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -621,8 +621,7 @@ static int udf_add_nondir(struct dentry
+ if (fibh.sbh != fibh.ebh)
+ brelse(fibh.ebh);
+ brelse(fibh.sbh);
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+
+ return 0;
+ }
+@@ -732,8 +731,7 @@ static int udf_mkdir(struct inode *dir,
+ inc_nlink(dir);
+ dir->i_ctime = dir->i_mtime = current_time(dir);
+ mark_inode_dirty(dir);
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ if (fibh.sbh != fibh.ebh)
+ brelse(fibh.ebh);
+ brelse(fibh.sbh);
+--- a/fs/ufs/namei.c
++++ b/fs/ufs/namei.c
+@@ -38,8 +38,7 @@ static inline int ufs_add_nondir(struct
+ {
+ int err = ufs_add_link(dentry, inode);
+ if (!err) {
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ return 0;
+ }
+ inode_dec_link_count(inode);
+@@ -192,8 +191,7 @@ static int ufs_mkdir(struct inode * dir,
+ if (err)
+ goto out_fail;
+
+- unlock_new_inode(inode);
+- d_instantiate(dentry, inode);
++ d_instantiate_new(dentry, inode);
+ return 0;
+
+ out_fail:
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -220,6 +220,7 @@ extern seqlock_t rename_lock;
+ * These are the low-level FS interfaces to the dcache..
+ */
+ extern void d_instantiate(struct dentry *, struct inode *);
++extern void d_instantiate_new(struct dentry *, struct inode *);
+ extern struct dentry * d_instantiate_unique(struct dentry *, struct inode *);
+ extern int d_instantiate_no_diralias(struct dentry *, struct inode *);
+ extern void __d_drop(struct dentry *dentry);
diff --git a/patches.fixes/f2fs-call-unlock_new_inode-before-d_instantiate.patch b/patches.fixes/f2fs-call-unlock_new_inode-before-d_instantiate.patch
deleted file mode 100644
index 73a00fe999..0000000000
--- a/patches.fixes/f2fs-call-unlock_new_inode-before-d_instantiate.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From ab3835aae642a602d98505afbfceb37707bf3ffe Mon Sep 17 00:00:00 2001
-From: Eric Biggers <ebiggers@google.com>
-Date: Wed, 18 Apr 2018 15:48:42 -0700
-Subject: [PATCH] f2fs: call unlock_new_inode() before d_instantiate()
-Git-commit: ab3835aae642a602d98505afbfceb37707bf3ffe
-Patch-mainline: v4.18-rc1
-References: bsc#1101837
-
-xfstest generic/429 sometimes hangs on f2fs, caused by a thread being
-unable to take a directory's i_rwsem for write in vfs_rmdir(). In the
-test, one thread repeatedly creates and removes a directory, and other
-threads repeatedly look up a file in the directory. The bug is that
-f2fs_mkdir() calls d_instantiate() before unlock_new_inode(), resulting
-in the directory inode being exposed to lookups before it has been fully
-initialized. And with CONFIG_DEBUG_LOCK_ALLOC, unlock_new_inode()
-reinitializes ->i_rwsem, corrupting its state when it is already held.
-
-Fix it by calling unlock_new_inode() before d_instantiate(). This
-matches what other filesystems do.
-
-Fixes: 57397d86c62d ("f2fs: add inode operations for special inodes")
-Signed-off-by: Eric Biggers <ebiggers@google.com>
-Reviewed-by: Chao Yu <yuchao0@huawei.com>
-Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
-Acked-by: Jan Kara <jack@suse.cz>
-
----
- fs/f2fs/namei.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
-index d5098efe577c..3a7ed962d2f7 100644
---- a/fs/f2fs/namei.c
-+++ b/fs/f2fs/namei.c
-@@ -294,8 +294,8 @@ static int f2fs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
-
- alloc_nid_done(sbi, ino);
-
-- d_instantiate(dentry, inode);
- unlock_new_inode(inode);
-+ d_instantiate(dentry, inode);
-
- if (IS_DIRSYNC(dir))
- f2fs_sync_fs(sbi->sb, 1);
-@@ -597,8 +597,8 @@ static int f2fs_symlink(struct inode *dir, struct dentry *dentry,
- err = page_symlink(inode, disk_link.name, disk_link.len);
-
- err_out:
-- d_instantiate(dentry, inode);
- unlock_new_inode(inode);
-+ d_instantiate(dentry, inode);
-
- /*
- * Let's flush symlink data in order to avoid broken symlink as much as
-@@ -661,8 +661,8 @@ static int f2fs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
-
- alloc_nid_done(sbi, inode->i_ino);
-
-- d_instantiate(dentry, inode);
- unlock_new_inode(inode);
-+ d_instantiate(dentry, inode);
-
- if (IS_DIRSYNC(dir))
- f2fs_sync_fs(sbi->sb, 1);
-@@ -713,8 +713,8 @@ static int f2fs_mknod(struct inode *dir, struct dentry *dentry,
-
- alloc_nid_done(sbi, inode->i_ino);
-
-- d_instantiate(dentry, inode);
- unlock_new_inode(inode);
-+ d_instantiate(dentry, inode);
-
- if (IS_DIRSYNC(dir))
- f2fs_sync_fs(sbi->sb, 1);
---
-2.16.4
-
diff --git a/series.conf b/series.conf
index 2658ad663c..8e577de661 100644
--- a/series.conf
+++ b/series.conf
@@ -15662,6 +15662,7 @@
patches.suse/bpf-prevent-memory-disambiguation-attack.patch
patches.fixes/0001-iov_iter-fix-return-type-of-_pipe_get_pages.patch
patches.fixes/0002-iov_iter-fix-memory-leak-in-pipe_get_pages_alloc.patch
+ patches.fixes/do-d_instantiate-unlock_new_inode-combinations-safel.patch
patches.fixes/fs-don-t-scan-the-inode-cache-before-SB_BORN-is-set.patch
patches.fixes/affs_lookup-close-a-race-with-affs_remove_link.patch
patches.fixes/befs_lookup-use-d_splice_alias.patch
@@ -16609,7 +16610,6 @@
patches.drivers/backlight-max8925_bl-Fix-Device-Tree-node-lookup
patches.drivers/backlight-tps65217_bl-Fix-Device-Tree-node-lookup
patches.drivers/backlight-as3711_bl-Fix-Device-Tree-node-leaks
- patches.fixes/f2fs-call-unlock_new_inode-before-d_instantiate.patch
patches.fixes/watchdog-da9063-Fix-setting-changing-timeout.patch
patches.fixes/watchdog-da9063-Fix-updating-timeout-value.patch
patches.fixes/watchdog-da9063-Fix-timeout-handling-during-probe.patch