lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

xfs: fix stale inode flush avoidance

Browse Source 
When reclaiming stale inodes, we need to guarantee that inodes are
unpinned before returning with a "clean" status. If we don't we can
reclaim inodes that are pinned, leading to use after free in the
transaction subsystem as transactions complete.

Signed-off-by: Dave Chinner <david@fromorbit.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Alex Elder <aelder@sgi.com>
This commit is contained in:
Dave Chinner
2010-01-11 11:45:21 +00:00
committed by Alex Elder
parent 126976c7c1
commit 4b6a46882c
1 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
fs/xfs/xfs_inode.c
View File

@@ -2842,13 +2842,9 @@ xfs_iflush(
/* /*
* If the inode isn't dirty, then just release the inode flush lock and * If the inode isn't dirty, then just release the inode flush lock and
* do nothing. Treat stale inodes the same; we cannot rely on the * do nothing.
* backing buffer remaining stale in cache for the remaining life of
* the stale inode and so xfs_itobp() below may give us a buffer that
* no longer contains inodes below. Doing this stale check here also
* avoids forcing the log on pinned, stale inodes.
*/ */
if (xfs_inode_clean(ip) || xfs_iflags_test(ip, XFS_ISTALE)) { if (xfs_inode_clean(ip)) {
xfs_ifunlock(ip); xfs_ifunlock(ip);
return 0; return 0;
} }
@@ -2871,6 +2867,19 @@ xfs_iflush(
} }
xfs_iunpin_wait(ip); xfs_iunpin_wait(ip);
/*
* For stale inodes we cannot rely on the backing buffer remaining
* stale in cache for the remaining life of the stale inode and so
* xfs_itobp() below may give us a buffer that no longer contains
* inodes below. We have to check this after ensuring the inode is
* unpinned so that it is safe to reclaim the stale inode after the
* flush call.
*/
if (xfs_iflags_test(ip, XFS_ISTALE)) {
xfs_ifunlock(ip);
return 0;
}
/* /*
* This may have been unpinned because the filesystem is shutting * This may have been unpinned because the filesystem is shutting
* down forcibly. If that's the case we must not write this inode * down forcibly. If that's the case we must not write this inode