[PATCH] dcache d_drop() bug fix / __d_drop() use fix

[PATCH] dcache d_drop() bug fix / __d_drop() use fix

[Jan Blunck]

[-- Attachment #1: Type: text/plain, Size: 718 bytes --]

This is a re-submission of the patch I sent about a month ago.

While working on my code I realized that d_drop() might race against 
__d_lookup(). __d_drop() (which is called by d_drop() after acquiring 
the dcache_lock) is accessing dentry->d_flags to set the DCACHE_UNHASHED 
flag. This shouldn't be done without holding dentry->d_lock, like stated 
in dcache.h:

struct dentry {
	...
	unsigned int d_flags;		/* protected by d_lock */
         ...
};

Therefore d_drop() must acquire the dentry->d_lock. Likewise every use 
of __d_drop() must acquire that lock.

This patch fixes d_drop() and every grep'able __d_drop() use. This patch 
is against today's http://linux.bkbits.net/linux-2.5.

Comments please,
Jan



[-- Attachment #2: d_drop-locking.diff --]
[-- Type: text/x-patch, Size: 3739 bytes --]

Signed-off-by: Jan Blunck <j.blunck@tu-harburg.de>

 fs/autofs4/root.c      |    2 ++
 fs/dcache.c            |    3 +++
 fs/namei.c             |   14 +++++---------
 fs/proc/base.c         |    6 +++++-
 fs/sysfs/inode.c       |    6 +++++-
 include/linux/dcache.h |    2 ++
 6 files changed, 22 insertions(+), 11 deletions(-)

Index: testing-um/include/linux/dcache.h
===================================================================
--- testing-um.orig/include/linux/dcache.h
+++ testing-um/include/linux/dcache.h
@@ -186,7 +186,9 @@ static inline void __d_drop(struct dentr
 static inline void d_drop(struct dentry *dentry)
 {
 	spin_lock(&dcache_lock);
+	spin_lock(&dentry->d_lock);
  	__d_drop(dentry);
+	spin_unlock(&dentry->d_lock);
 	spin_unlock(&dcache_lock);
 }
 
Index: testing-um/fs/namei.c
===================================================================
--- testing-um.orig/fs/namei.c
+++ testing-um/fs/namei.c
@@ -1685,17 +1685,13 @@ out:
 void dentry_unhash(struct dentry *dentry)
 {
 	dget(dentry);
-	spin_lock(&dcache_lock);
-	switch (atomic_read(&dentry->d_count)) {
-	default:
-		spin_unlock(&dcache_lock);
+	if (atomic_read(&dentry->d_count))
 		shrink_dcache_parent(dentry);
-		spin_lock(&dcache_lock);
-		if (atomic_read(&dentry->d_count) != 2)
-			break;
-	case 2:
+	spin_lock(&dcache_lock);
+	spin_lock(&dentry->d_lock);
+	if (atomic_read(&dentry->d_count) == 2)
 		__d_drop(dentry);
-	}
+	spin_unlock(&dentry->d_lock);
 	spin_unlock(&dcache_lock);
 }
 
Index: testing-um/fs/sysfs/inode.c
===================================================================
--- testing-um.orig/fs/sysfs/inode.c
+++ testing-um/fs/sysfs/inode.c
@@ -129,13 +129,17 @@ void sysfs_drop_dentry(struct sysfs_dire
 
 	if (dentry) {
 		spin_lock(&dcache_lock);
+		spin_lock(&dentry->d_lock);
 		if (!(d_unhashed(dentry) && dentry->d_inode)) {
 			dget_locked(dentry);
 			__d_drop(dentry);
+			spin_unlock(&dentry->d_lock);
 			spin_unlock(&dcache_lock);
 			simple_unlink(parent->d_inode, dentry);
-		} else
+		} else {
+			spin_unlock(&dentry->d_lock);
 			spin_unlock(&dcache_lock);
+		}
 	}
 }
 
Index: testing-um/fs/dcache.c
===================================================================
--- testing-um.orig/fs/dcache.c
+++ testing-um/fs/dcache.c
@@ -340,13 +340,16 @@ restart:
 	tmp = head;
 	while ((tmp = tmp->next) != head) {
 		struct dentry *dentry = list_entry(tmp, struct dentry, d_alias);
+		spin_lock(&dentry->d_lock);
 		if (!atomic_read(&dentry->d_count)) {
 			__dget_locked(dentry);
 			__d_drop(dentry);
+			spin_unlock(&dentry->d_lock);
 			spin_unlock(&dcache_lock);
 			dput(dentry);
 			goto restart;
 		}
+		spin_unlock(&dentry->d_lock);
 	}
 	spin_unlock(&dcache_lock);
 }
Index: testing-um/fs/autofs4/root.c
===================================================================
--- testing-um.orig/fs/autofs4/root.c
+++ testing-um/fs/autofs4/root.c
@@ -605,7 +605,9 @@ static int autofs4_dir_rmdir(struct inod
 		spin_unlock(&dcache_lock);
 		return -ENOTEMPTY;
 	}
+	spin_lock(&dentry->d_lock);
 	__d_drop(dentry);
+	spin_unlock(&dentry->d_lock);
 	spin_unlock(&dcache_lock);
 
 	dput(ino->dentry);
Index: testing-um/fs/proc/base.c
===================================================================
--- testing-um.orig/fs/proc/base.c
+++ testing-um/fs/proc/base.c
@@ -1630,11 +1630,15 @@ struct dentry *proc_pid_unhash(struct ta
 	if (proc_dentry != NULL) {
 
 		spin_lock(&dcache_lock);
+		spin_lock(&proc_dentry->d_lock);
 		if (!d_unhashed(proc_dentry)) {
 			dget_locked(proc_dentry);
 			__d_drop(proc_dentry);
-		} else
+			spin_unlock(&proc_dentry->d_lock);
+		} else {
+			spin_unlock(&proc_dentry->d_lock);
 			proc_dentry = NULL;
+		}
 		spin_unlock(&dcache_lock);
 	}
 	return proc_dentry;

Re: [PATCH] dcache d_drop() bug fix / __d_drop() use fix

[raven]

On Wed, 16 Feb 2005, Jan Blunck wrote:

> This is a re-submission of the patch I sent about a month ago.
>
> While working on my code I realized that d_drop() might race against 
> __d_lookup(). __d_drop() (which is called by d_drop() after acquiring the 
> dcache_lock) is accessing dentry->d_flags to set the DCACHE_UNHASHED flag. 
> This shouldn't be done without holding dentry->d_lock, like stated in 
> dcache.h:
>
> struct dentry {
> ...
> unsigned int d_flags;		/* protected by d_lock */
>        ...
> };
>
> Therefore d_drop() must acquire the dentry->d_lock. Likewise every use of 
> __d_drop() must acquire that lock.
>
> This patch fixes d_drop() and every grep'able __d_drop() use. This patch is 
> against today's http://linux.bkbits.net/linux-2.5.
>

For my part, in autofs4, I would prefer:

--- linux-2.6.9/fs/autofs4/root.c.d_lock	2005-02-16 23:15:18.000000000 +0800
+++ linux-2.6.9/fs/autofs4/root.c	2005-02-16 23:15:35.000000000 +0800
@@ -621,7 +621,7 @@
  		spin_unlock(&dcache_lock);
  		return -ENOTEMPTY;
  	}
-	__d_drop(dentry);
+	d_drop(dentry);
  	spin_unlock(&dcache_lock);

  	dput(ino->dentry);

Re: [PATCH] dcache d_drop() bug fix / __d_drop() use fix

[Jeff Moyer]

==> Regarding Re: [PATCH] dcache d_drop() bug fix / __d_drop() use fix; raven@themaw.net adds:

raven> On Wed, 16 Feb 2005, Jan Blunck wrote:
>> This is a re-submission of the patch I sent about a month ago.
>> 
>> While working on my code I realized that d_drop() might race against 
>> __d_lookup(). __d_drop() (which is called by d_drop() after acquiring the 
>> dcache_lock) is accessing dentry->d_flags to set the DCACHE_UNHASHED flag. 
>> This shouldn't be done without holding dentry->d_lock, like stated in 
>> dcache.h:
>> 
>> struct dentry {
>> ...
>> unsigned int d_flags;		/* protected by d_lock */
>> ...
>> };
>> 
>> Therefore d_drop() must acquire the dentry->d_lock. Likewise every use of 
>> __d_drop() must acquire that lock.
>> 
>> This patch fixes d_drop() and every grep'able __d_drop() use. This patch is 
>> against today's http://linux.bkbits.net/linux-2.5.
>> 

raven> For my part, in autofs4, I would prefer:

> --- linux-2.6.9/fs/autofs4/root.c.d_lock	2005-02-16 23:15:18.000000000 +0800
> +++ linux-2.6.9/fs/autofs4/root.c	2005-02-16 23:15:35.000000000 +0800
> @@ -621,7 +621,7 @@
>   		spin_unlock(&dcache_lock);
>   		return -ENOTEMPTY;
>   	}
> -	__d_drop(dentry);
> +	d_drop(dentry);
>   	spin_unlock(&dcache_lock);

>   	dput(ino->dentry);

Ian, this would deadlock.  You already hold the dcache lock here, and
d_drop takes it:

static inline void d_drop(struct dentry *dentry)
{
        spin_lock(&dcache_lock);
        __d_drop(dentry);
        spin_unlock(&dcache_lock);
}

The proposed patch was to take the dentry->d_lock.

-Jeff

Re: [PATCH] dcache d_drop() bug fix / __d_drop() use fix

[Ian Kent]

On Wed, 16 Feb 2005, Jeff Moyer wrote:

> ==> Regarding Re: [PATCH] dcache d_drop() bug fix / __d_drop() use fix; raven@themaw.net adds:
> 
> raven> On Wed, 16 Feb 2005, Jan Blunck wrote:
> >> This is a re-submission of the patch I sent about a month ago.
> >> 
> >> While working on my code I realized that d_drop() might race against 
> >> __d_lookup(). __d_drop() (which is called by d_drop() after acquiring the 
> >> dcache_lock) is accessing dentry->d_flags to set the DCACHE_UNHASHED flag. 
> >> This shouldn't be done without holding dentry->d_lock, like stated in 
> >> dcache.h:
> >> 
> >> struct dentry {
> >> ...
> >> unsigned int d_flags;		/* protected by d_lock */
> >> ...
> >> };
> >> 
> >> Therefore d_drop() must acquire the dentry->d_lock. Likewise every use of 
> >> __d_drop() must acquire that lock.
> >> 
> >> This patch fixes d_drop() and every grep'able __d_drop() use. This patch is 
> >> against today's http://linux.bkbits.net/linux-2.5.
> >> 
> 
> raven> For my part, in autofs4, I would prefer:
> 
> > --- linux-2.6.9/fs/autofs4/root.c.d_lock	2005-02-16 23:15:18.000000000 +0800
> > +++ linux-2.6.9/fs/autofs4/root.c	2005-02-16 23:15:35.000000000 +0800
> > @@ -621,7 +621,7 @@
> >   		spin_unlock(&dcache_lock);
> >   		return -ENOTEMPTY;
> >   	}
> > -	__d_drop(dentry);
> > +	d_drop(dentry);
> >   	spin_unlock(&dcache_lock);
> 
> >   	dput(ino->dentry);
> 
> Ian, this would deadlock.  You already hold the dcache lock here, and
> d_drop takes it:

Ha!

Yes. There is a difference between d_lock and dcache_lock.
I need glasses!

Please ignore what I said.

Ian