• Al Viro's avatar
    udf: fix the udf_iget() vs. udf_new_inode() races · b2315096
    Al Viro authored
    Currently udf_iget() (triggered by NFS) can race with udf_new_inode()
    leading to two inode structures with the same inode number:
    
    nfsd: iget_locked() creates inode
    nfsd: try to read from disk, block on that.
    udf_new_inode(): allocate inode with that inumber
    udf_new_inode(): insert it into icache, set it up and dirty
    udf_write_inode(): write inode into buffer cache
    nfsd: get CPU again, look into buffer cache, see nice and sane on-disk
      inode, set the in-core inode from it
    
    Fix the problem by putting inode into icache in locked state (I_NEW set)
    and unlocking it only after it's fully set up.
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: default avatarJan Kara <jack@suse.cz>
    b2315096
ialloc.c 3.36 KB