nfsd race fixes: ext2

* make ext2_new_inode() put the inode into icache in locked state
* do not unlock until the inode is fully set up; otherwise nfsd
might pick it in half-baked state.
* make sure that ext2_new_inode() does *not* lead to two inodes with the
same inumber hashed at the same time; otherwise a bogus fhandle coming
from nfsd might race with inode creation:

nfsd: iget_locked() creates inode
nfsd: try to read from disk, block on that.
ext2_new_inode(): allocate inode with that inumber
ext2_new_inode(): insert it into icache, set it up and dirty
ext2_write_inode(): get the relevant part of inode table in cache,
set the entry for our inode (and start writing to disk)
nfsd: get CPU again, look into inode table, see nice and sane on-disk
inode, set the in-core inode from it

oops - we have two in-core inodes with the same inumber live in icache,
both used for IO.  Welcome to fs corruption...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c
index 8d0add62587020ab8299e33dd8a6b5ac4edae500..c454d5db28a5aef07d2585d3a672bb5310c3fa4b 100644 (file)
--- a/fs/ext2/ialloc.c
+++ b/fs/ext2/ialloc.c
@@ -585,7 +585,10 @@ got:
        spin_lock(&sbi->s_next_gen_lock);
        inode->i_generation = sbi->s_next_generation++;
        spin_unlock(&sbi->s_next_gen_lock);
-       insert_inode_hash(inode);
+       if (insert_inode_locked(inode) < 0) {
+               err = -EINVAL;
+               goto fail_drop;
+       }
 
        if (DQUOT_ALLOC_INODE(inode)) {
                err = -EDQUOT;
@@ -612,6 +615,7 @@ fail_drop:
        DQUOT_DROP(inode);
        inode->i_flags |= S_NOQUOTA;
        inode->i_nlink = 0;
+       unlock_new_inode(inode);
        iput(inode);
        return ERR_PTR(err);
 

diff --git a/fs/ext2/namei.c b/fs/ext2/namei.c
index 2a747252ec1204776d7ba99d9b7147872c060743..90ea17998a7390afa2cb9bb03ffc14d440f6a51e 100644 (file)
--- a/fs/ext2/namei.c
+++ b/fs/ext2/namei.c
@@ -41,9 +41,11 @@ static inline int ext2_add_nondir(struct dentry *dentry, struct inode *inode)
        int err = ext2_add_link(dentry, inode);
        if (!err) {
                d_instantiate(dentry, inode);
+               unlock_new_inode(inode);
                return 0;
        }
        inode_dec_link_count(inode);
+       unlock_new_inode(inode);
        iput(inode);
        return err;
 }
@@ -170,6 +172,7 @@ out:
 
 out_fail:
        inode_dec_link_count(inode);
+       unlock_new_inode(inode);
        iput (inode);
        goto out;
 }
@@ -178,6 +181,7 @@ static int ext2_link (struct dentry * old_dentry, struct inode * dir,
        struct dentry *dentry)
 {
        struct inode *inode = old_dentry->d_inode;
+       int err;
 
        if (inode->i_nlink >= EXT2_LINK_MAX)
                return -EMLINK;
@@ -186,7 +190,14 @@ static int ext2_link (struct dentry * old_dentry, struct inode * dir,
        inode_inc_link_count(inode);
        atomic_inc(&inode->i_count);
 
-       return ext2_add_nondir(dentry, inode);
+       err = ext2_add_link(dentry, inode);
+       if (!err) {
+               d_instantiate(dentry, inode);
+               return 0;
+       }
+       inode_dec_link_count(inode);
+       iput(inode);
+       return err;
 }
 
 static int ext2_mkdir(struct inode * dir, struct dentry * dentry, int mode)
@@ -222,12 +233,14 @@ static int ext2_mkdir(struct inode * dir, struct dentry * dentry, int mode)
                goto out_fail;
 
        d_instantiate(dentry, inode);
+       unlock_new_inode(inode);
 out:
        return err;
 
 out_fail:
        inode_dec_link_count(inode);
        inode_dec_link_count(inode);
+       unlock_new_inode(inode);
        iput(inode);
 out_dir:
        inode_dec_link_count(dir);