• Andreas Gruenbacher's avatar
    gfs2: gl_object races fix · 9ffa1888
    Andreas Gruenbacher authored
    Function glock_clear_object() checks if the specified glock is still
    pointing at the right object and clears the gl_object pointer.  To
    handle the case of incompletely constructed inodes, glock_clear_object()
    also allows gl_object to be NULL.
    
    However, in the teardown case, when iget_failed() is called and the
    inode is removed from the inode hash, by the time we get to the
    glock_clear_object() calls in gfs2_put_super() and its helpers, we don't
    have exclusion against concurrent gfs2_inode_lookup() and
    gfs2_create_inode() calls, and the inode and iopen glocks may already be
    pointing at another inode, so the checks in glock_clear_object() are
    incorrect.
    
    To better handle this case, always completely disassociate an inode from
    its glocks before tearing it down.  In addition, get rid of a duplicate
    glock_clear_object() call in gfs2_evict_inode().  That way,
    glock_clear_object() will only ever be called when the glock points at
    the current inode, and the NULL check in glock_clear_object() can be
    removed.
    Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
    9ffa1888
super.c 37.4 KB