From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, "Al Viro" <viro@zeniv.linux.org.uk>
Subject: [PATCH 3.2 14/27] deal with deadlock in d_walk()
Date: Mon, 29 Dec 2014 02:11:31 +0100 [thread overview]
Message-ID: <lsq.1419815491.439721348@decadent.org.uk> (raw)
In-Reply-To: <lsq.1419815490.288081487@decadent.org.uk>
3.2.66-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit ca5358ef75fc69fee5322a38a340f5739d997c10 upstream.
... by not hitting rename_retry for reasons other than rename having
happened. In other words, do _not_ restart when finding that
between unlocking the child and locking the parent the former got
into __dentry_kill(). Skip the killed siblings instead...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[bwh: Backported to 3.2:
- As we only have try_to_ascend() and not d_walk(), apply this
change to all callers of try_to_ascend()
- Adjust context to make __dentry_kill() apply to d_kill()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/dcache.c | 31 ++++++++++++++++---------------
1 file changed, 16 insertions(+), 15 deletions(-)
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -306,9 +306,9 @@ static struct dentry *d_kill(struct dent
__releases(parent->d_lock)
__releases(dentry->d_inode->i_lock)
{
- list_del(&dentry->d_child);
+ __list_del_entry(&dentry->d_child);
/*
- * Inform try_to_ascend() that we are no longer attached to the
+ * Inform ascending readers that we are no longer attached to the
* dentry tree
*/
dentry->d_flags |= DCACHE_DENTRY_KILLED;
@@ -949,34 +949,6 @@ void shrink_dcache_for_umount(struct sup
}
}
-/*
- * This tries to ascend one level of parenthood, but
- * we can race with renaming, so we need to re-check
- * the parenthood after dropping the lock and check
- * that the sequence number still matches.
- */
-static struct dentry *try_to_ascend(struct dentry *old, int locked, unsigned seq)
-{
- struct dentry *new = old->d_parent;
-
- rcu_read_lock();
- spin_unlock(&old->d_lock);
- spin_lock(&new->d_lock);
-
- /*
- * might go back up the wrong parent if we have had a rename
- * or deletion
- */
- if (new != old->d_parent ||
- (old->d_flags & DCACHE_DENTRY_KILLED) ||
- (!locked && read_seqretry(&rename_lock, seq))) {
- spin_unlock(&new->d_lock);
- new = NULL;
- }
- rcu_read_unlock();
- return new;
-}
-
/*
* Search for at least 1 mount point in the dentry's subdirs.
@@ -1032,17 +1004,32 @@ resume:
/*
* All done at this level ... ascend and resume the search.
*/
+ rcu_read_lock();
+ascend:
if (this_parent != parent) {
struct dentry *child = this_parent;
- this_parent = try_to_ascend(this_parent, locked, seq);
- if (!this_parent)
+ this_parent = child->d_parent;
+
+ spin_unlock(&child->d_lock);
+ spin_lock(&this_parent->d_lock);
+
+ /* might go back up the wrong parent if we have had a rename */
+ if (!locked && read_seqretry(&rename_lock, seq))
goto rename_retry;
next = child->d_child.next;
+ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
+ if (next == &this_parent->d_subdirs)
+ goto ascend;
+ child = list_entry(next, struct dentry, d_child);
+ next = next->next;
+ }
+ rcu_read_unlock();
goto resume;
}
- spin_unlock(&this_parent->d_lock);
if (!locked && read_seqretry(&rename_lock, seq))
goto rename_retry;
+ spin_unlock(&this_parent->d_lock);
+ rcu_read_unlock();
if (locked)
write_sequnlock(&rename_lock);
return 0; /* No mount points found in tree */
@@ -1054,6 +1041,8 @@ positive:
return 1;
rename_retry:
+ spin_unlock(&this_parent->d_lock);
+ rcu_read_unlock();
if (locked)
goto again;
locked = 1;
@@ -1139,23 +1128,40 @@ resume:
/*
* All done at this level ... ascend and resume the search.
*/
+ rcu_read_lock();
+ascend:
if (this_parent != parent) {
struct dentry *child = this_parent;
- this_parent = try_to_ascend(this_parent, locked, seq);
- if (!this_parent)
+ this_parent = child->d_parent;
+
+ spin_unlock(&child->d_lock);
+ spin_lock(&this_parent->d_lock);
+
+ /* might go back up the wrong parent if we have had a rename */
+ if (!locked && read_seqretry(&rename_lock, seq))
goto rename_retry;
next = child->d_child.next;
+ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
+ if (next == &this_parent->d_subdirs)
+ goto ascend;
+ child = list_entry(next, struct dentry, d_child);
+ next = next->next;
+ }
+ rcu_read_unlock();
goto resume;
}
out:
- spin_unlock(&this_parent->d_lock);
if (!locked && read_seqretry(&rename_lock, seq))
goto rename_retry;
+ spin_unlock(&this_parent->d_lock);
+ rcu_read_unlock();
if (locked)
write_sequnlock(&rename_lock);
return found;
rename_retry:
+ spin_unlock(&this_parent->d_lock);
+ rcu_read_unlock();
if (found)
return found;
if (locked)
@@ -2914,26 +2920,43 @@ resume:
}
spin_unlock(&dentry->d_lock);
}
+ rcu_read_lock();
+ascend:
if (this_parent != root) {
struct dentry *child = this_parent;
if (!(this_parent->d_flags & DCACHE_GENOCIDE)) {
this_parent->d_flags |= DCACHE_GENOCIDE;
this_parent->d_count--;
}
- this_parent = try_to_ascend(this_parent, locked, seq);
- if (!this_parent)
+ this_parent = child->d_parent;
+
+ spin_unlock(&child->d_lock);
+ spin_lock(&this_parent->d_lock);
+
+ /* might go back up the wrong parent if we have had a rename */
+ if (!locked && read_seqretry(&rename_lock, seq))
goto rename_retry;
next = child->d_child.next;
+ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
+ if (next == &this_parent->d_subdirs)
+ goto ascend;
+ child = list_entry(next, struct dentry, d_child);
+ next = next->next;
+ }
+ rcu_read_unlock();
goto resume;
}
- spin_unlock(&this_parent->d_lock);
if (!locked && read_seqretry(&rename_lock, seq))
goto rename_retry;
+ spin_unlock(&this_parent->d_lock);
+ rcu_read_unlock();
if (locked)
write_sequnlock(&rename_lock);
return;
rename_retry:
+ spin_unlock(&this_parent->d_lock);
+ rcu_read_unlock();
if (locked)
goto again;
locked = 1;
next prev parent reply other threads:[~2014-12-29 1:16 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-12-29 1:11 [PATCH 3.2 00/27] 3.2.66-rc1 review Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 25/27] drivers/net: macvtap and tun depend on INET Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 24/27] ipv4: dst_entry leak in ip_send_unicast_reply() Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 03/27] sata_fsl: fix error handling of irq_of_parse_and_map Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 12/27] x86, kvm: Clear paravirt_enabled on KVM guests for espfix32's benefit Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 11/27] [media] ttusb-dec: buffer overflow in ioctl Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 02/27] AHCI: Add DeviceIDs for Sunrise Point-LP SATA controller Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 16/27] s390,time: revert direct ktime path for s390 clockevent device Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 10/27] x86/tls: Validate TLS entries to protect espfix Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 21/27] ipv4: fix nexthop attlen check in fib_nh_match Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 15/27] ext4: make orphan functions be no-op in no-journal mode Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 20/27] net: sctp: fix memory leak in auth key management Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 13/27] move d_rcu from overlapping d_child to overlapping d_alias Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 08/27] net: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 22/27] tcp: md5: remove spinlock usage in fast path Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 06/27] i2c: davinci: generate STP always when NACK is received Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 05/27] ahci: disable MSI on SAMSUNG 0xa800 SSD Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 09/27] KVM: x86: Don't report guest userspace emulation error to userspace Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 17/27] drm: fix DRM_IOCTL_MODE_GETFB handle-leak Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 19/27] drivers/net, ipv6: Select IPv6 fragment idents for virtio UFO packets Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 23/27] tcp: md5: do not use alloc_percpu() Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 07/27] udf: Avoid infinite loop when processing indirect ICBs Ben Hutchings
2014-12-29 1:11 ` Ben Hutchings [this message]
2014-12-29 1:11 ` [PATCH 3.2 04/27] mm: fix swapoff hang after page migration and fork Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 01/27] drm/i915: Unlock panel even when LVDS is disabled Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 27/27] x86: kvm: use alternatives for VMCALL vs. VMMCALL if kernel text is read-only Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 18/27] crypto: ghash-clmulni-intel - use C implementation for setkey() Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 26/27] net: sctp: use MAX_HEADER for headroom reserve in output path Ben Hutchings
2014-12-29 1:14 ` [PATCH 3.2 00/27] 3.2.66-rc1 review Ben Hutchings
2014-12-29 9:39 ` Guenter Roeck
2014-12-29 11:28 ` Ben Hutchings
2014-12-30 0:26 ` Satoru Takeuchi
2014-12-30 1:56 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1419815491.439721348@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®