ext4: atomically set inode->i_flags in ext4_set_inode_flags()

commit 5f16f3225b06242a9ee876f07c1c9b6ed36a22b6 upstream.

Use cmpxchg() to atomically set i_flags instead of clearing out the
S_IMMUTABLE, S_APPEND, etc. flags and then setting them from the
EXT4_IMMUTABLE_FL, EXT4_APPEND_FL flags, since this opens up a race
where an immutable file has the immutable flag cleared for a brief
window of time.

js: there is no change for ext4. This patch defines merely
    inode_set_flags for jffs in the next patch. I wonder why do we
    have both inode_set_flags and set_mask_bits? Looks like an
    improperly resolved merge conflict.

Reported-by: John Sullivan <jsrhbz@kanargh.force9.co.uk>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Jiri Slaby <jslaby@suse.cz>

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index a58a796bb92b320ae75d59a4367a9f7c728a3f02..ba68d211d748aff6ed8496a9d1a6245ca48f4e54 100644 (file)
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3970,8 +3970,8 @@ void ext4_set_inode_flags(struct inode *inode)
                new_fl |= S_NOATIME;
        if (flags & EXT4_DIRSYNC_FL)
                new_fl |= S_DIRSYNC;
-       set_mask_bits(&inode->i_flags,
-                     S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC, new_fl);
+       inode_set_flags(inode, new_fl,
+                       S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC);
 }
 
 /* Propagate flags from i_flags to EXT4_I(inode)->i_flags */

diff --git a/fs/inode.c b/fs/inode.c
index 1e6e8468f2d8d6eb2027d14ef914f967b4d33313..d9134a0f5dd99763fc669c0149f7a2bad783acd3 100644 (file)
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1871,3 +1871,34 @@ void inode_dio_done(struct inode *inode)
                wake_up_bit(&inode->i_state, __I_DIO_WAKEUP);
 }
 EXPORT_SYMBOL(inode_dio_done);
+
+/*
+ * inode_set_flags - atomically set some inode flags
+ *
+ * Note: the caller should be holding i_mutex, or else be sure that
+ * they have exclusive access to the inode structure (i.e., while the
+ * inode is being instantiated).  The reason for the cmpxchg() loop
+ * --- which wouldn't be necessary if all code paths which modify
+ * i_flags actually followed this rule, is that there is at least one
+ * code path which doesn't today --- for example,
+ * __generic_file_aio_write() calls file_remove_suid() without holding
+ * i_mutex --- so we use cmpxchg() out of an abundance of caution.
+ *
+ * In the long run, i_mutex is overkill, and we should probably look
+ * at using the i_lock spinlock to protect i_flags, and then make sure
+ * it is so documented in include/linux/fs.h and that all code follows
+ * the locking convention!!
+ */
+void inode_set_flags(struct inode *inode, unsigned int flags,
+                    unsigned int mask)
+{
+       unsigned int old_flags, new_flags;
+
+       WARN_ON_ONCE(flags & ~mask);
+       do {
+               old_flags = ACCESS_ONCE(inode->i_flags);
+               new_flags = (old_flags & ~mask) | flags;
+       } while (unlikely(cmpxchg(&inode->i_flags, old_flags,
+                                 new_flags) != old_flags));
+}
+EXPORT_SYMBOL(inode_set_flags);

diff --git a/include/linux/fs.h b/include/linux/fs.h
index 6535d5af027edf8e390a3df74b46ee8554edab1c..9cb726aa09fc017735218b3a74f53c0a865a4aad 100644 (file)
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2496,6 +2496,9 @@ static inline ssize_t blockdev_direct_IO(int rw, struct kiocb *iocb,
 void inode_dio_wait(struct inode *inode);
 void inode_dio_done(struct inode *inode);
 
+extern void inode_set_flags(struct inode *inode, unsigned int flags,
+                           unsigned int mask);
+
 extern const struct file_operations generic_ro_fops;
 
 #define special_file(m) (S_ISCHR(m)||S_ISBLK(m)||S_ISFIFO(m)||S_ISSOCK(m))