From a97cb8dfea412ac4d42e1abcf9ed4ab0f8ebcbb3 Mon Sep 17 00:00:00 2001 From: Gustavo Solaira Date: Tue, 3 Jul 2018 16:02:32 -0700 Subject: [PATCH] Revert "do d_instantiate/unlock_new_inode combinations safely" This reverts commit 03bb7588942a38623f108b3302c2d1aebb525696. Causes oops with security smack enabled. Change-Id: I14fb2b0841c6b71940bd3f08bd4b49b1d7b039a3 Signed-off-by: Gustavo Solaira --- fs/btrfs/inode.c | 16 ++++++++++++---- fs/dcache.c | 22 ---------------------- fs/ecryptfs/inode.c | 3 ++- fs/ext2/namei.c | 6 ++++-- fs/ext4/namei.c | 6 ++++-- fs/f2fs/namei.c | 12 ++++++++---- fs/jffs2/dir.c | 12 ++++++++---- fs/jfs/namei.c | 12 ++++++++---- fs/nilfs2/namei.c | 6 ++++-- fs/reiserfs/namei.c | 12 ++++++++---- fs/udf/namei.c | 6 ++++-- fs/ufs/namei.c | 6 ++++-- include/linux/dcache.h | 1 - 13 files changed, 66 insertions(+), 54 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 1f01a8172308..81b5a461d94e 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -6413,7 +6413,8 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry, goto out_unlock_inode; } else { btrfs_update_inode(trans, root, inode); - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); } out_unlock: @@ -6488,7 +6489,8 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry, goto out_unlock_inode; BTRFS_I(inode)->io_tree.ops = &btrfs_extent_io_ops; - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); out_unlock: btrfs_end_transaction(trans, root); @@ -6631,7 +6633,12 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) if (err) goto out_fail_inode; - d_instantiate_new(dentry, inode); + d_instantiate(dentry, inode); + /* + * mkdir is special. We're unlocking after we call d_instantiate + * to avoid a race with nfsd calling d_instantiate. + */ + unlock_new_inode(inode); drop_on_err = 0; out_fail: @@ -9782,7 +9789,8 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry, goto out_unlock_inode; } - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); out_unlock: btrfs_end_transaction(trans, root); diff --git a/fs/dcache.c b/fs/dcache.c index 7df640155468..750ddc627855 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -1897,28 +1897,6 @@ struct dentry *d_instantiate_unique(struct dentry *entry, struct inode *inode) EXPORT_SYMBOL(d_instantiate_unique); -/* - * This should be equivalent to d_instantiate() + unlock_new_inode(), - * with lockdep-related part of unlock_new_inode() done before - * anything else. Use that instead of open-coding d_instantiate()/ - * unlock_new_inode() combinations. - */ -void d_instantiate_new(struct dentry *entry, struct inode *inode) -{ - BUG_ON(!hlist_unhashed(&entry->d_u.d_alias)); - BUG_ON(!inode); - lockdep_annotate_inode_mutex_key(inode); - security_d_instantiate(entry, inode); - spin_lock(&inode->i_lock); - __d_instantiate(entry, inode); - WARN_ON(!(inode->i_state & I_NEW)); - inode->i_state &= ~I_NEW; - smp_mb(); - wake_up_bit(&inode->i_state, __I_NEW); - spin_unlock(&inode->i_lock); -} -EXPORT_SYMBOL(d_instantiate_new); - /** * d_instantiate_no_diralias - instantiate a non-aliased dentry * @entry: dentry to complete diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c index d108ed116858..7f277e843ea5 100644 --- a/fs/ecryptfs/inode.c +++ b/fs/ecryptfs/inode.c @@ -298,7 +298,8 @@ ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry, ecryptfs_inode_to_lower(ecryptfs_inode), crypt_stat); - d_instantiate_new(ecryptfs_dentry, ecryptfs_inode); + unlock_new_inode(ecryptfs_inode); + d_instantiate(ecryptfs_dentry, ecryptfs_inode); out: return rc; } diff --git a/fs/ext2/namei.c b/fs/ext2/namei.c index da3d40ef1668..3267a80dbbe2 100644 --- a/fs/ext2/namei.c +++ b/fs/ext2/namei.c @@ -40,7 +40,8 @@ static inline int ext2_add_nondir(struct dentry *dentry, struct inode *inode) { int err = ext2_add_link(dentry, inode); if (!err) { - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); return 0; } inode_dec_link_count(inode); @@ -266,7 +267,8 @@ static int ext2_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode) if (err) goto out_fail; - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); out: return err; diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index cf09d5f71ad2..b9324d0ff218 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -2426,7 +2426,8 @@ static int ext4_add_nondir(handle_t *handle, int err = ext4_add_entry(handle, dentry, inode); if (!err) { ext4_mark_inode_dirty(handle, inode); - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); return 0; } drop_nlink(inode); @@ -2665,7 +2666,8 @@ out_clear_inode: err = ext4_mark_inode_dirty(handle, dir); if (err) goto out_clear_inode; - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); if (IS_DIRSYNC(dir)) ext4_handle_sync(handle); diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 0355891dbbf8..5ec20f077629 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -294,7 +294,8 @@ static int f2fs_create(struct inode *dir, struct dentry *dentry, umode_t mode, alloc_nid_done(sbi, ino); - d_instantiate_new(dentry, inode); + d_instantiate(dentry, inode); + unlock_new_inode(inode); if (IS_DIRSYNC(dir)) f2fs_sync_fs(sbi->sb, 1); @@ -593,7 +594,8 @@ static int f2fs_symlink(struct inode *dir, struct dentry *dentry, err = page_symlink(inode, disk_link.name, disk_link.len); err_out: - d_instantiate_new(dentry, inode); + d_instantiate(dentry, inode); + unlock_new_inode(inode); /* * Let's flush symlink data in order to avoid broken symlink as much as @@ -656,7 +658,8 @@ static int f2fs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) alloc_nid_done(sbi, inode->i_ino); - d_instantiate_new(dentry, inode); + d_instantiate(dentry, inode); + unlock_new_inode(inode); if (IS_DIRSYNC(dir)) f2fs_sync_fs(sbi->sb, 1); @@ -707,7 +710,8 @@ static int f2fs_mknod(struct inode *dir, struct dentry *dentry, alloc_nid_done(sbi, inode->i_ino); - d_instantiate_new(dentry, inode); + d_instantiate(dentry, inode); + unlock_new_inode(inode); if (IS_DIRSYNC(dir)) f2fs_sync_fs(sbi->sb, 1); diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c index e27317169697..30c4c9ebb693 100644 --- a/fs/jffs2/dir.c +++ b/fs/jffs2/dir.c @@ -207,7 +207,8 @@ static int jffs2_create(struct inode *dir_i, struct dentry *dentry, __func__, inode->i_ino, inode->i_mode, inode->i_nlink, f->inocache->pino_nlink, inode->i_mapping->nrpages); - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); return 0; fail: @@ -427,7 +428,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char mutex_unlock(&dir_f->sem); jffs2_complete_reservation(c); - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); return 0; fail: @@ -571,7 +573,8 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, umode_t mode mutex_unlock(&dir_f->sem); jffs2_complete_reservation(c); - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); return 0; fail: @@ -742,7 +745,8 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, umode_t mode mutex_unlock(&dir_f->sem); jffs2_complete_reservation(c); - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); return 0; fail: diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c index f217ae750adb..9d7551f5c32a 100644 --- a/fs/jfs/namei.c +++ b/fs/jfs/namei.c @@ -178,7 +178,8 @@ static int jfs_create(struct inode *dip, struct dentry *dentry, umode_t mode, unlock_new_inode(ip); iput(ip); } else { - d_instantiate_new(dentry, ip); + unlock_new_inode(ip); + d_instantiate(dentry, ip); } out2: @@ -312,7 +313,8 @@ static int jfs_mkdir(struct inode *dip, struct dentry *dentry, umode_t mode) unlock_new_inode(ip); iput(ip); } else { - d_instantiate_new(dentry, ip); + unlock_new_inode(ip); + d_instantiate(dentry, ip); } out2: @@ -1056,7 +1058,8 @@ static int jfs_symlink(struct inode *dip, struct dentry *dentry, unlock_new_inode(ip); iput(ip); } else { - d_instantiate_new(dentry, ip); + unlock_new_inode(ip); + d_instantiate(dentry, ip); } out2: @@ -1440,7 +1443,8 @@ static int jfs_mknod(struct inode *dir, struct dentry *dentry, unlock_new_inode(ip); iput(ip); } else { - d_instantiate_new(dentry, ip); + unlock_new_inode(ip); + d_instantiate(dentry, ip); } out1: diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c index cd7f5b0abe84..c9a1a491aa91 100644 --- a/fs/nilfs2/namei.c +++ b/fs/nilfs2/namei.c @@ -50,7 +50,8 @@ static inline int nilfs_add_nondir(struct dentry *dentry, struct inode *inode) { int err = nilfs_add_link(dentry, inode); if (!err) { - d_instantiate_new(dentry, inode); + d_instantiate(dentry, inode); + unlock_new_inode(inode); return 0; } inode_dec_link_count(inode); @@ -245,7 +246,8 @@ static int nilfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) goto out_fail; nilfs_mark_inode_dirty(inode); - d_instantiate_new(dentry, inode); + d_instantiate(dentry, inode); + unlock_new_inode(inode); out: if (!err) err = nilfs_transaction_commit(dir->i_sb); diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c index eb611bdd4725..3ebc70167e41 100644 --- a/fs/reiserfs/namei.c +++ b/fs/reiserfs/namei.c @@ -687,7 +687,8 @@ static int reiserfs_create(struct inode *dir, struct dentry *dentry, umode_t mod reiserfs_update_inode_transaction(inode); reiserfs_update_inode_transaction(dir); - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); retval = journal_end(&th); out_failed: @@ -770,7 +771,8 @@ static int reiserfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode goto out_failed; } - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); retval = journal_end(&th); out_failed: @@ -869,7 +871,8 @@ static int reiserfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode /* the above add_entry did not update dir's stat data */ reiserfs_update_sd(&th, dir); - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); retval = journal_end(&th); out_failed: reiserfs_write_unlock(dir->i_sb); @@ -1183,7 +1186,8 @@ static int reiserfs_symlink(struct inode *parent_dir, goto out_failed; } - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); retval = journal_end(&th); out_failed: reiserfs_write_unlock(parent_dir->i_sb); diff --git a/fs/udf/namei.c b/fs/udf/namei.c index f34c545f4e54..c97b5a8d1e24 100644 --- a/fs/udf/namei.c +++ b/fs/udf/namei.c @@ -611,7 +611,8 @@ static int udf_add_nondir(struct dentry *dentry, struct inode *inode) if (fibh.sbh != fibh.ebh) brelse(fibh.ebh); brelse(fibh.sbh); - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); return 0; } @@ -721,7 +722,8 @@ static int udf_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) inc_nlink(dir); dir->i_ctime = dir->i_mtime = current_fs_time(dir->i_sb); mark_inode_dirty(dir); - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); if (fibh.sbh != fibh.ebh) brelse(fibh.ebh); brelse(fibh.sbh); diff --git a/fs/ufs/namei.c b/fs/ufs/namei.c index 2ec7689c25cf..47966554317c 100644 --- a/fs/ufs/namei.c +++ b/fs/ufs/namei.c @@ -38,7 +38,8 @@ static inline int ufs_add_nondir(struct dentry *dentry, struct inode *inode) { int err = ufs_add_link(dentry, inode); if (!err) { - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); return 0; } inode_dec_link_count(inode); @@ -190,7 +191,8 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode) if (err) goto out_fail; - d_instantiate_new(dentry, inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); return 0; out_fail: diff --git a/include/linux/dcache.h b/include/linux/dcache.h index 9df992b818a4..c066f6b56e58 100644 --- a/include/linux/dcache.h +++ b/include/linux/dcache.h @@ -238,7 +238,6 @@ extern seqlock_t rename_lock; * These are the low-level FS interfaces to the dcache.. */ extern void d_instantiate(struct dentry *, struct inode *); -extern void d_instantiate_new(struct dentry *, struct inode *); extern struct dentry * d_instantiate_unique(struct dentry *, struct inode *); extern int d_instantiate_no_diralias(struct dentry *, struct inode *); extern void __d_drop(struct dentry *dentry);