From 0c12bbf97bc07a9cc3688b436cefdbe3dde3f14c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 26 May 2018 12:44:38 +0200 Subject: [PATCH] 3.18-stable patches added patches: do-d_instantiate-unlock_new_inode-combinations-safely.patch --- ...unlock_new_inode-combinations-safely.patch | 426 ++++++++++++++++++ queue-3.18/series | 1 + 2 files changed, 427 insertions(+) create mode 100644 queue-3.18/do-d_instantiate-unlock_new_inode-combinations-safely.patch diff --git a/queue-3.18/do-d_instantiate-unlock_new_inode-combinations-safely.patch b/queue-3.18/do-d_instantiate-unlock_new_inode-combinations-safely.patch new file mode 100644 index 00000000000..e264cf5c780 --- /dev/null +++ b/queue-3.18/do-d_instantiate-unlock_new_inode-combinations-safely.patch @@ -0,0 +1,426 @@ +From 1e2e547a93a00ebc21582c06ca3c6cfea2a309ee Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Fri, 4 May 2018 08:23:01 -0400 +Subject: do d_instantiate/unlock_new_inode combinations safely + +From: Al Viro + +commit 1e2e547a93a00ebc21582c06ca3c6cfea2a309ee upstream. + +For anything NFS-exported we do _not_ want to unlock new inode +before it has grown an alias; original set of fixes got the +ordering right, but missed the nasty complication in case of +lockdep being enabled - unlock_new_inode() does + lockdep_annotate_inode_mutex_key(inode) +which can only be done before anyone gets a chance to touch +->i_mutex. Unfortunately, flipping the order and doing +unlock_new_inode() before d_instantiate() opens a window when +mkdir can race with open-by-fhandle on a guessed fhandle, leading +to multiple aliases for a directory inode and all the breakage +that follows from that. + + Correct solution: a new primitive (d_instantiate_new()) +combining these two in the right order - lockdep annotate, then +d_instantiate(), then the rest of unlock_new_inode(). All +combinations of d_instantiate() with unlock_new_inode() should +be converted to that. + +Cc: stable@kernel.org # 2.6.29 and later +Tested-by: Mike Marshall +Reviewed-by: Andreas Dilger +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/inode.c | 16 ++++------------ + fs/dcache.c | 22 ++++++++++++++++++++++ + fs/ecryptfs/inode.c | 3 +-- + fs/ext2/namei.c | 6 ++---- + fs/ext4/namei.c | 6 ++---- + fs/f2fs/namei.c | 12 ++++-------- + fs/jffs2/dir.c | 12 ++++-------- + fs/jfs/namei.c | 12 ++++-------- + fs/nilfs2/namei.c | 6 ++---- + fs/reiserfs/namei.c | 12 ++++-------- + fs/udf/namei.c | 6 ++---- + fs/ufs/namei.c | 6 ++---- + include/linux/dcache.h | 1 + + 13 files changed, 54 insertions(+), 66 deletions(-) + +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -5996,8 +5996,7 @@ static int btrfs_mknod(struct inode *dir + goto out_unlock_inode; + } else { + btrfs_update_inode(trans, root, inode); +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + } + + out_unlock: +@@ -6073,8 +6072,7 @@ static int btrfs_create(struct inode *di + goto out_unlock_inode; + + BTRFS_I(inode)->io_tree.ops = &btrfs_extent_io_ops; +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + + out_unlock: + btrfs_end_transaction(trans, root); +@@ -6217,12 +6215,7 @@ static int btrfs_mkdir(struct inode *dir + if (err) + goto out_fail_inode; + +- d_instantiate(dentry, inode); +- /* +- * mkdir is special. We're unlocking after we call d_instantiate +- * to avoid a race with nfsd calling d_instantiate. +- */ +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + drop_on_err = 0; + + out_fail: +@@ -9251,8 +9244,7 @@ static int btrfs_symlink(struct inode *d + goto out_unlock_inode; + } + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + + out_unlock: + btrfs_end_transaction(trans, root); +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -1868,6 +1868,28 @@ static struct dentry * __d_find_any_alia + return alias; + } + ++/* ++ * This should be equivalent to d_instantiate() + unlock_new_inode(), ++ * with lockdep-related part of unlock_new_inode() done before ++ * anything else. Use that instead of open-coding d_instantiate()/ ++ * unlock_new_inode() combinations. ++ */ ++void d_instantiate_new(struct dentry *entry, struct inode *inode) ++{ ++ BUG_ON(!hlist_unhashed(&entry->d_u.d_alias)); ++ BUG_ON(!inode); ++ lockdep_annotate_inode_mutex_key(inode); ++ security_d_instantiate(entry, inode); ++ spin_lock(&inode->i_lock); ++ __d_instantiate(entry, inode); ++ WARN_ON(!(inode->i_state & I_NEW)); ++ inode->i_state &= ~I_NEW; ++ smp_mb(); ++ wake_up_bit(&inode->i_state, __I_NEW); ++ spin_unlock(&inode->i_lock); ++} ++EXPORT_SYMBOL(d_instantiate_new); ++ + /** + * d_find_any_alias - find any alias for a given inode + * @inode: inode to find an alias for +--- a/fs/ecryptfs/inode.c ++++ b/fs/ecryptfs/inode.c +@@ -289,8 +289,7 @@ ecryptfs_create(struct inode *directory_ + iput(ecryptfs_inode); + goto out; + } +- unlock_new_inode(ecryptfs_inode); +- d_instantiate(ecryptfs_dentry, ecryptfs_inode); ++ d_instantiate_new(ecryptfs_dentry, ecryptfs_inode); + out: + return rc; + } +--- a/fs/ext2/namei.c ++++ b/fs/ext2/namei.c +@@ -41,8 +41,7 @@ static inline int ext2_add_nondir(struct + { + int err = ext2_add_link(dentry, inode); + if (!err) { +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + return 0; + } + inode_dec_link_count(inode); +@@ -265,8 +264,7 @@ static int ext2_mkdir(struct inode * dir + if (err) + goto out_fail; + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + out: + return err; + +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -2205,8 +2205,7 @@ static int ext4_add_nondir(handle_t *han + int err = ext4_add_entry(handle, dentry, inode); + if (!err) { + ext4_mark_inode_dirty(handle, inode); +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + return 0; + } + drop_nlink(inode); +@@ -2440,8 +2439,7 @@ out_clear_inode: + err = ext4_mark_inode_dirty(handle, dir); + if (err) + goto out_clear_inode; +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + if (IS_DIRSYNC(dir)) + ext4_handle_sync(handle); + +--- a/fs/f2fs/namei.c ++++ b/fs/f2fs/namei.c +@@ -129,8 +129,7 @@ static int f2fs_create(struct inode *dir + + alloc_nid_done(sbi, ino); + +- d_instantiate(dentry, inode); +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + return 0; + out: + handle_failed_inode(inode); +@@ -259,8 +258,7 @@ static int f2fs_symlink(struct inode *di + err = page_symlink(inode, symname, symlen); + alloc_nid_done(sbi, inode->i_ino); + +- d_instantiate(dentry, inode); +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + return err; + out: + handle_failed_inode(inode); +@@ -293,8 +291,7 @@ static int f2fs_mkdir(struct inode *dir, + + alloc_nid_done(sbi, inode->i_ino); + +- d_instantiate(dentry, inode); +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + + return 0; + +@@ -338,8 +335,7 @@ static int f2fs_mknod(struct inode *dir, + f2fs_unlock_op(sbi); + + alloc_nid_done(sbi, inode->i_ino); +- d_instantiate(dentry, inode); +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + return 0; + out: + handle_failed_inode(inode); +--- a/fs/jffs2/dir.c ++++ b/fs/jffs2/dir.c +@@ -207,8 +207,7 @@ static int jffs2_create(struct inode *di + __func__, inode->i_ino, inode->i_mode, inode->i_nlink, + f->inocache->pino_nlink, inode->i_mapping->nrpages); + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + return 0; + + fail: +@@ -427,8 +426,7 @@ static int jffs2_symlink (struct inode * + mutex_unlock(&dir_f->sem); + jffs2_complete_reservation(c); + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + return 0; + + fail: +@@ -572,8 +570,7 @@ static int jffs2_mkdir (struct inode *di + mutex_unlock(&dir_f->sem); + jffs2_complete_reservation(c); + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + return 0; + + fail: +@@ -747,8 +744,7 @@ static int jffs2_mknod (struct inode *di + mutex_unlock(&dir_f->sem); + jffs2_complete_reservation(c); + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + return 0; + + fail: +--- a/fs/jfs/namei.c ++++ b/fs/jfs/namei.c +@@ -176,8 +176,7 @@ static int jfs_create(struct inode *dip, + unlock_new_inode(ip); + iput(ip); + } else { +- unlock_new_inode(ip); +- d_instantiate(dentry, ip); ++ d_instantiate_new(dentry, ip); + } + + out2: +@@ -309,8 +308,7 @@ static int jfs_mkdir(struct inode *dip, + unlock_new_inode(ip); + iput(ip); + } else { +- unlock_new_inode(ip); +- d_instantiate(dentry, ip); ++ d_instantiate_new(dentry, ip); + } + + out2: +@@ -1043,8 +1041,7 @@ static int jfs_symlink(struct inode *dip + unlock_new_inode(ip); + iput(ip); + } else { +- unlock_new_inode(ip); +- d_instantiate(dentry, ip); ++ d_instantiate_new(dentry, ip); + } + + out2: +@@ -1424,8 +1421,7 @@ static int jfs_mknod(struct inode *dir, + unlock_new_inode(ip); + iput(ip); + } else { +- unlock_new_inode(ip); +- d_instantiate(dentry, ip); ++ d_instantiate_new(dentry, ip); + } + + out1: +--- a/fs/nilfs2/namei.c ++++ b/fs/nilfs2/namei.c +@@ -50,8 +50,7 @@ static inline int nilfs_add_nondir(struc + { + int err = nilfs_add_link(dentry, inode); + if (!err) { +- d_instantiate(dentry, inode); +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + return 0; + } + inode_dec_link_count(inode); +@@ -249,8 +248,7 @@ static int nilfs_mkdir(struct inode *dir + goto out_fail; + + nilfs_mark_inode_dirty(inode); +- d_instantiate(dentry, inode); +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + out: + if (!err) + err = nilfs_transaction_commit(dir->i_sb); +--- a/fs/reiserfs/namei.c ++++ b/fs/reiserfs/namei.c +@@ -682,8 +682,7 @@ static int reiserfs_create(struct inode + reiserfs_update_inode_transaction(inode); + reiserfs_update_inode_transaction(dir); + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + retval = journal_end(&th); + + out_failed: +@@ -763,8 +762,7 @@ static int reiserfs_mknod(struct inode * + goto out_failed; + } + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + retval = journal_end(&th); + + out_failed: +@@ -857,8 +855,7 @@ static int reiserfs_mkdir(struct inode * + /* the above add_entry did not update dir's stat data */ + reiserfs_update_sd(&th, dir); + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + retval = journal_end(&th); + out_failed: + reiserfs_write_unlock(dir->i_sb); +@@ -1162,8 +1159,7 @@ static int reiserfs_symlink(struct inode + goto out_failed; + } + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + retval = journal_end(&th); + out_failed: + reiserfs_write_unlock(parent_dir->i_sb); +--- a/fs/udf/namei.c ++++ b/fs/udf/namei.c +@@ -574,8 +574,7 @@ static int udf_add_nondir(struct dentry + if (fibh.sbh != fibh.ebh) + brelse(fibh.ebh); + brelse(fibh.sbh); +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + + return 0; + } +@@ -684,8 +683,7 @@ static int udf_mkdir(struct inode *dir, + udf_write_fi(dir, &cfi, fi, &fibh, NULL, NULL); + inc_nlink(dir); + mark_inode_dirty(dir); +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + if (fibh.sbh != fibh.ebh) + brelse(fibh.ebh); + brelse(fibh.sbh); +--- a/fs/ufs/namei.c ++++ b/fs/ufs/namei.c +@@ -38,8 +38,7 @@ static inline int ufs_add_nondir(struct + { + int err = ufs_add_link(dentry, inode); + if (!err) { +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + return 0; + } + inode_dec_link_count(inode); +@@ -212,8 +211,7 @@ static int ufs_mkdir(struct inode * dir, + goto out_fail; + unlock_ufs(dir->i_sb); + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + out: + return err; + +--- a/include/linux/dcache.h ++++ b/include/linux/dcache.h +@@ -231,6 +231,7 @@ extern seqlock_t rename_lock; + * These are the low-level FS interfaces to the dcache.. + */ + extern void d_instantiate(struct dentry *, struct inode *); ++extern void d_instantiate_new(struct dentry *, struct inode *); + extern struct dentry * d_instantiate_unique(struct dentry *, struct inode *); + extern struct dentry * d_materialise_unique(struct dentry *, struct inode *); + extern int d_instantiate_no_diralias(struct dentry *, struct inode *); diff --git a/queue-3.18/series b/queue-3.18/series index 93d7b9d5f85..6a874e2015a 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -3,3 +3,4 @@ mips-fix-ptrace-2-ptrace_peekusr-and-ptrace_pokeusr-accesses-to-o32-fgrs.patch kvm-fix-spelling-mistake-cop_unsuable-cop_unusable.patch affs_lookup-close-a-race-with-affs_remove_link.patch aio-fix-io_destroy-2-vs.-lookup_ioctx-race.patch +do-d_instantiate-unlock_new_inode-combinations-safely.patch -- 2.47.2