summaryrefslogtreecommitdiff
path: root/fs/udf/ialloc.c
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2014-09-04 17:38:11 +0400
committerJan Kara <jack@suse.cz>2014-09-04 23:37:41 +0400
commitb231509616feb911c2a7a8814d58c0014ef5b17f (patch)
treeda9d231b09ee58637fb671310291432929c9db56 /fs/udf/ialloc.c
parentd2be51cb34dc501791f3b8c01a99a3f2064bd8d1 (diff)
downloadlinux-b231509616feb911c2a7a8814d58c0014ef5b17f.tar.xz
udf: fix the udf_iget() vs. udf_new_inode() races
Currently udf_iget() (triggered by NFS) can race with udf_new_inode() leading to two inode structures with the same inode number: nfsd: iget_locked() creates inode nfsd: try to read from disk, block on that. udf_new_inode(): allocate inode with that inumber udf_new_inode(): insert it into icache, set it up and dirty udf_write_inode(): write inode into buffer cache nfsd: get CPU again, look into buffer cache, see nice and sane on-disk inode, set the in-core inode from it Fix the problem by putting inode into icache in locked state (I_NEW set) and unlocking it only after it's fully set up. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'fs/udf/ialloc.c')
-rw-r--r--fs/udf/ialloc.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/fs/udf/ialloc.c b/fs/udf/ialloc.c
index 647370d70175..598f33bdcd26 100644
--- a/fs/udf/ialloc.c
+++ b/fs/udf/ialloc.c
@@ -124,7 +124,12 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode, int *err)
iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
inode->i_mtime = inode->i_atime = inode->i_ctime =
iinfo->i_crtime = current_fs_time(inode->i_sb);
- insert_inode_hash(inode);
+ if (unlikely(insert_inode_locked(inode) < 0)) {
+ make_bad_inode(inode);
+ iput(inode);
+ *err = -EIO;
+ return NULL;
+ }
mark_inode_dirty(inode);
*err = 0;