Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[XFS] Fix an inode use-after-free durin an unpin. When reclaiming inodes

Browse source 
that have been unlinked, we may need to execute transactions during
reclaim. By the time the transaction has hit the disk, the linux inode and
xfs vnode may already have been freed so we can't reference them safely.
Use the known xfs inode state to determine if it is safe to reference the
vnode and linux inode during the unpin operation.

SGI-PV: 946321
SGI-Modid: xfs-linux-melb:xfs-kern:25687a

Signed-off-by: David Chinner <dgc@sgi.com>
Signed-off-by: Nathan Scott <nathans@sgi.com>
This commit is contained in:
David Chinner 2006-04-11 15:11:20 +10:00 committed by Nathan Scott
parent 1fc5d959d8
commit 58829e490e
1 changed files with 20 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
fs/xfs/xfs_inode.c
View file

@ -2732,16 +2732,29 @@ xfs_iunpin(
ASSERT(atomic_read(&ip->i_pincount) > 0); ASSERT(atomic_read(&ip->i_pincount) > 0);
if (atomic_dec_and_test(&ip->i_pincount)) { if (atomic_dec_and_test(&ip->i_pincount)) {
vnode_t *vp = XFS_ITOV_NULL(ip); /*
* If the inode is currently being reclaimed, the
* linux inode _and_ the xfs vnode may have been
* freed so we cannot reference either of them safely.
* Hence we should not try to do anything to them
* if the xfs inode is currently in the reclaim
* path.
*
* However, we still need to issue the unpin wakeup
* call as the inode reclaim may be blocked waiting for
* the inode to become unpinned.
*/
if (!(ip->i_flags & (XFS_IRECLAIM|XFS_IRECLAIMABLE))) {
vnode_t *vp = XFS_ITOV_NULL(ip);
/* make sync come back and flush this inode */ /* make sync come back and flush this inode */
if (vp) { if (vp) {
struct inode *inode = vn_to_inode(vp); struct inode *inode = vn_to_inode(vp);
if (!(inode->i_state & I_NEW)) if (!(inode->i_state & I_NEW))
mark_inode_dirty_sync(inode); mark_inode_dirty_sync(inode);
}
} }
wake_up(&ip->i_ipin_wait); wake_up(&ip->i_ipin_wait);
} }
} }