summaryrefslogtreecommitdiff
path: root/fs/ubifs/dir.c
diff options
context:
space:
mode:
authorHunter Adrian <adrian.hunter@nokia.com>2009-05-14 06:32:30 +0200
committerArtem Bityutskiy <Artem.Bityutskiy@nokia.com>2009-05-19 11:01:31 +0300
commit8b3884a841f398f6e0a0411d6929d8d9381bb265 (patch)
tree01bbbaad779c43b14ea3e809c5fc9271eca257d4 /fs/ubifs/dir.c
parent6d6cb0d688d0f262cb4fd5771648b0ac01d4f82c (diff)
UBIFS: return error if link and unlink race
Consider a scenario when 'vfs_link(dirA/fileA)' and 'vfs_unlink(dirA/fileA, dirB/fileB)' race. 'vfs_link()' does not lock 'dirA->i_mutex', so this is possible. Both of the functions lock 'fileA->i_mutex' though. Suppose 'vfs_unlink()' wins, and takes 'fileA->i_mutex' mutex first. Suppose 'fileA->i_nlink' is 1. In this case 'ubifs_unlink()' will drop the last reference, and put 'inodeA' to the list of orphans. After this, 'vfs_link()' will link 'dirB/fileB' to 'inodeA'. Thir is a problem because, for example, the subsequent 'vfs_unlink(dirB/fileB)' will add the same inode to the list of orphans. This problem was reported by J. R. Okajima <hooanon05@yahoo.co.jp> [Artem: add more comments, amended commit message] Signed-off-by: Adrian Hunter <adrian.hunter@nokia.com> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Diffstat (limited to 'fs/ubifs/dir.c')
-rw-r--r--fs/ubifs/dir.c19
1 files changed, 19 insertions, 0 deletions
diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index f55d523c52bb..552fb0111fff 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -528,6 +528,25 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir,
inode->i_nlink, dir->i_ino);
ubifs_assert(mutex_is_locked(&dir->i_mutex));
ubifs_assert(mutex_is_locked(&inode->i_mutex));
+
+ /*
+ * Return -ENOENT if we've raced with unlink and i_nlink is 0. Doing
+ * otherwise has the potential to corrupt the orphan inode list.
+ *
+ * Indeed, consider a scenario when 'vfs_link(dirA/fileA)' and
+ * 'vfs_unlink(dirA/fileA, dirB/fileB)' race. 'vfs_link()' does not
+ * lock 'dirA->i_mutex', so this is possible. Both of the functions
+ * lock 'fileA->i_mutex' though. Suppose 'vfs_unlink()' wins, and takes
+ * 'fileA->i_mutex' mutex first. Suppose 'fileA->i_nlink' is 1. In this
+ * case 'ubifs_unlink()' will drop the last reference, and put 'inodeA'
+ * to the list of orphans. After this, 'vfs_link()' will link
+ * 'dirB/fileB' to 'inodeA'. This is a problem because, for example,
+ * the subsequent 'vfs_unlink(dirB/fileB)' will add the same inode
+ * to the list of orphans.
+ */
+ if (inode->i_nlink == 0)
+ return -ENOENT;
+
err = dbg_check_synced_i_size(inode);
if (err)
return err;