Revision 1e9c75fb9c47a75a9aec0cd17db5f6dc36b58e00 authored by Benjamin Coddington on 03 October 2018, 14:18:33 UTC, committed by Eric W. Biederman on 12 November 2018, 07:02:34 UTC
Since commit ff17fa561a04 ("d_invalidate(): unhash immediately") immediately unhashes the dentry, we'll never return the mountpoint in lookup_mountpoint(), which can lead to an unbreakable loop in d_invalidate(). I have reports of NFS clients getting into this condition after the server removes an export of an existing mount created through follow_automount(), but I suspect there are various other ways to produce this problem if we hunt down users of d_invalidate(). For example, it is possible to get into this state by using XFS' d_invalidate() call in xfs_vn_unlink(): truncate -s 100m img{1,2} mkfs.xfs -q -n version=ci img1 mkfs.xfs -q -n version=ci img2 mkdir -p /mnt/xfs mount img1 /mnt/xfs mkdir /mnt/xfs/sub1 mount img2 /mnt/xfs/sub1 cat > /mnt/xfs/sub1/foo & umount -l /mnt/xfs/sub1 mount img2 /mnt/xfs/sub1 mount --make-private /mnt/xfs mkdir /mnt/xfs/sub2 mount --move /mnt/xfs/sub1 /mnt/xfs/sub2 rmdir /mnt/xfs/sub1 Fix this by moving the check for an unlinked dentry out of the detach_mounts() path. Fixes: ff17fa561a04 ("d_invalidate(): unhash immediately") Cc: stable@vger.kernel.org Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Benjamin Coddington <bcodding@redhat.com> Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
1 parent 9c8e0a1
File | Mode | Size |
---|---|---|
platform | ||
acbuffer.h | -rw-r--r-- | 8.6 KB |
acconfig.h | -rw-r--r-- | 7.4 KB |
acexcep.h | -rw-r--r-- | 16.8 KB |
acnames.h | -rw-r--r-- | 2.1 KB |
acoutput.h | -rw-r--r-- | 16.1 KB |
acpi.h | -rw-r--r-- | 1.3 KB |
acpi_bus.h | -rw-r--r-- | 19.1 KB |
acpi_drivers.h | -rw-r--r-- | 4.1 KB |
acpi_io.h | -rw-r--r-- | 713 bytes |
acpi_lpat.h | -rw-r--r-- | 1.5 KB |
acpi_numa.h | -rw-r--r-- | 623 bytes |
acpiosxf.h | -rw-r--r-- | 11.3 KB |
acpixf.h | -rw-r--r-- | 30.2 KB |
acrestyp.h | -rw-r--r-- | 18.8 KB |
actbl.h | -rw-r--r-- | 18.3 KB |
actbl1.h | -rw-r--r-- | 40.3 KB |
actbl2.h | -rw-r--r-- | 45.3 KB |
actbl3.h | -rw-r--r-- | 20.0 KB |
actypes.h | -rw-r--r-- | 40.7 KB |
acuuid.h | -rw-r--r-- | 2.4 KB |
apei.h | -rw-r--r-- | 1.3 KB |
battery.h | -rw-r--r-- | 561 bytes |
button.h | -rw-r--r-- | 621 bytes |
cppc_acpi.h | -rw-r--r-- | 3.1 KB |
ghes.h | -rw-r--r-- | 2.9 KB |
hed.h | -rw-r--r-- | 371 bytes |
nfit.h | -rw-r--r-- | 351 bytes |
pcc.h | -rw-r--r-- | 816 bytes |
pdc_intel.h | -rw-r--r-- | 1.0 KB |
processor.h | -rw-r--r-- | 11.0 KB |
reboot.h | -rw-r--r-- | 201 bytes |
video.h | -rw-r--r-- | 2.8 KB |
Computing file changes ...