Re: [PATCH] First casuality of hlist poisoning in 2.5.70

[Trond Myklebust <trond.myklebust@fys.uio.no>]

>>>>> " " == Linus Torvalds <torvalds@transmeta.com> writes:

    >> - hlist_del_rcu(&dentry->d_hash);
    >> - hlist_add_head_rcu(&dentry->d_hash, target->d_bucket);
    >> + if (!hlist_unhashed(&dentry->d_hash))
    >> + hlist_del_rcu(&dentry->d_hash);
    >> + if (!hlist_unhashed(&target->d_hash)) {
    >> + hlist_add_head_rcu(&dentry->d_hash, target->d_bucket);
    >> + dentry->d_vfs_flags &= ~DCACHE_UNHASHED;
    >> + } else
    >> + dentry->d_vfs_flags |= DCACHE_UNHASHED;

     > Can source or target really be validly unhashed? That makes no
     > sense, since we just looked it up, and we've held the directory
     > semaphores over the whole thing.

When renaming, we may want to unhash the dentry in order to stop
d_lookup()s from succeeding (Recall that cached_lookup() does not
attempt to take the directory semaphore - only real_lookup() does
that).

AFAICS one should not rehash the dentry until after the d_move(). Does
that make sense?

Cheers,
   Trond