d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

VOP_LOOKUP() may relock the directory vnode for some reasons. Since

Browse Source 
nullfs vnode shares vnode lock with lower vnode, this allows the
reclamation of nullfs directory vnode in null_lookup().  In this
situation, VOP must return ENOENT.

More, since after the reclamation, the locks of nullfs directory vnode
and lower vnode are no longer shared, the relock of the ldvp does not
restore the correct locking state of dvp, and leaks ldvp lock.
Correct this by unlocking ldvp and locking dvp.

Use cached value of dvp->v_mount.

Reported by:	bdrewery
Tested by:	pho
Sponsored by:	The FreeBSD Foundation
MFC after:	2 weeks
This commit is contained in:
Konstantin Belousov 2014-08-08 11:39:05 +00:00
parent eb5eb08820
commit effc6a3593
1 changed files with 40 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
sys/fs/nullfs/null_vnops.c
View File

@ -361,9 +361,11 @@ null_lookup(struct vop_lookup_args *ap)
struct vnode *dvp = ap->a_dvp;
int flags = cnp->cn_flags;
struct vnode *vp, *ldvp, *lvp;
struct mount *mp;
int error;
if ((flags & ISLASTCN) && (dvp->v_mount->mnt_flag & MNT_RDONLY) &&
mp = dvp->v_mount;
if ((flags & ISLASTCN) != 0 && (mp->mnt_flag & MNT_RDONLY) != 0 &&
(cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME))
return (EROFS);
/*
@ -376,9 +378,43 @@ null_lookup(struct vop_lookup_args *ap)
((dvp->v_vflag & VV_ROOT) != 0 && (flags & ISDOTDOT) == 0),
("ldvp %p fl %#x dvp %p fl %#x flags %#x", ldvp, ldvp->v_vflag,
dvp, dvp->v_vflag, flags));
/*
* Hold ldvp. The reference on it, owned by dvp, is lost in
* case of dvp reclamation, and we need ldvp to move our lock
* from ldvp to dvp.
*/
vhold(ldvp);
error = VOP_LOOKUP(ldvp, &lvp, cnp);
if (error == EJUSTRETURN && (flags & ISLASTCN) &&
(dvp->v_mount->mnt_flag & MNT_RDONLY) &&
/*
* VOP_LOOKUP() on lower vnode may unlock ldvp, which allows
* dvp to be reclaimed due to shared v_vnlock. Check for the
* doomed state and return error.
*/
if ((error == 0 || error == EJUSTRETURN) &&
(dvp->v_iflag & VI_DOOMED) != 0) {
error = ENOENT;
if (lvp != NULL)
vput(lvp);
/*
* If vgone() did reclaimed dvp before curthread
* relocked ldvp, the locks of dvp and ldpv are no
* longer shared. In this case, relock of ldvp in
* lower fs VOP_LOOKUP() does not restore the locking
* state of dvp. Compensate for this by unlocking
* ldvp and locking dvp, which is also correct if the
* locks are still shared.
*/
VOP_UNLOCK(ldvp, 0);
vn_lock(dvp, LK_EXCLUSIVE | LK_RETRY);
}
vdrop(ldvp);
if (error == EJUSTRETURN && (flags & ISLASTCN) != 0 &&
(mp->mnt_flag & MNT_RDONLY) != 0 &&
(cnp->cn_nameiop == CREATE || cnp->cn_nameiop == RENAME))
error = EROFS;
@ -388,7 +424,7 @@ null_lookup(struct vop_lookup_args *ap)
VREF(dvp);
vrele(lvp);
} else {
error = null_nodeget(dvp->v_mount, lvp, &vp);
error = null_nodeget(mp, lvp, &vp);
if (error == 0)
*ap->a_vpp = vp;
}