[PATCH 4.9 008/329] do d_instantiate/unlock_new_inode combinations safely

28 May 2018

4.9-stable review patch.  If anyone has any objections, please let me know.
------------------
From: Al Viro viro@zeniv.linux.org.uk
commit 1e2e547a93a00ebc21582c06ca3c6cfea2a309ee upstream.
For anything NFS-exported we do _not_ want to unlock new inode
before it has grown an alias; original set of fixes got the
ordering right, but missed the nasty complication in case of
lockdep being enabled - unlock_new_inode() does
    lockdep_annotate_inode_mutex_key(inode)
which can only be done before anyone gets a chance to touch
->i_mutex.  Unfortunately, flipping the order and doing
unlock_new_inode() before d_instantiate() opens a window when
mkdir can race with open-by-fhandle on a guessed fhandle, leading
to multiple aliases for a directory inode and all the breakage
that follows from that.
Correct solution: a new primitive (d_instantiate_new())
combining these two in the right order - lockdep annotate, then
d_instantiate(), then the rest of unlock_new_inode().  All
combinations of d_instantiate() with unlock_new_inode() should
be converted to that.
Cc: stable@kernel.org	# 2.6.29 and later
Tested-by: Mike Marshall hubcap@omnibond.com
Reviewed-by: Andreas Dilger adilger@dilger.ca
Signed-off-by: Al Viro viro@zeniv.linux.org.uk
Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
---
 fs/btrfs/inode.c       |   16 ++++------------
 fs/dcache.c            |   22 ++++++++++++++++++++++
 fs/ecryptfs/inode.c    |    3 +--
 fs/ext2/namei.c        |    6 ++----
 fs/ext4/namei.c        |    6 ++----
 fs/f2fs/namei.c        |   12 ++++--------
 fs/jffs2/dir.c         |   12 ++++--------
 fs/jfs/namei.c         |   12 ++++--------
 fs/nilfs2/namei.c      |    6 ++----
 fs/orangefs/namei.c    |    9 +++------
 fs/reiserfs/namei.c    |   12 ++++--------
 fs/udf/namei.c         |    6 ++----
 fs/ufs/namei.c         |    6 ++----
 include/linux/dcache.h |    1 +
 14 files changed, 57 insertions(+), 72 deletions(-)

--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6491,8 +6491,7 @@ static int btrfs_mknod(struct inode *dir
    	goto out_unlock_inode;
    } else {
    	btrfs_update_inode(trans, root, inode);
-		unlock_new_inode(inode);
-		d_instantiate(dentry, inode);
+		d_instantiate_new(dentry, inode);
    }
out_unlock:
@@ -6567,8 +6566,7 @@ static int btrfs_create(struct inode *di
    	goto out_unlock_inode;
BTRFS_I(inode)->io_tree.ops = &btrfs_extent_io_ops;
-	unlock_new_inode(inode);
-	d_instantiate(dentry, inode);
+	d_instantiate_new(dentry, inode);
out_unlock:
    btrfs_end_transaction(trans, root);
@@ -6711,12 +6709,7 @@ static int btrfs_mkdir(struct inode *dir
    if (err)
    	goto out_fail_inode;
-	d_instantiate(dentry, inode);
-	/*
-	 * mkdir is special.  We're unlocking after we call d_instantiate
-	 * to avoid a race with nfsd calling d_instantiate.
-	 */
-	unlock_new_inode(inode);
+	d_instantiate_new(dentry, inode);
    drop_on_err = 0;
out_fail:
@@ -10354,8 +10347,7 @@ static int btrfs_symlink(struct inode *d
    	goto out_unlock_inode;
    }
-	unlock_new_inode(inode);
-	d_instantiate(dentry, inode);
+	d_instantiate_new(dentry, inode);
out_unlock:
    btrfs_end_transaction(trans, root);
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1859,6 +1859,28 @@ void d_instantiate(struct dentry *entry,
 }
 EXPORT_SYMBOL(d_instantiate);
+/*
+ * This should be equivalent to d_instantiate() + unlock_new_inode(),
+ * with lockdep-related part of unlock_new_inode() done before
+ * anything else.  Use that instead of open-coding d_instantiate()/
+ * unlock_new_inode() combinations.
+ */
+void d_instantiate_new(struct dentry *entry, struct inode *inode)
+{
+	BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
+	BUG_ON(!inode);
+	lockdep_annotate_inode_mutex_key(inode);
+	security_d_instantiate(entry, inode);
+	spin_lock(&inode->i_lock);
+	__d_instantiate(entry, inode);
+	WARN_ON(!(inode->i_state & I_NEW));
+	inode->i_state &= ~I_NEW;
+	smp_mb();
+	wake_up_bit(&inode->i_state, __I_NEW);
+	spin_unlock(&inode->i_lock);
+}
+EXPORT_SYMBOL(d_instantiate_new);
+
 /**
  * d_instantiate_no_diralias - instantiate a non-aliased dentry
  * @entry: dentry to complete
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -284,8 +284,7 @@ ecryptfs_create(struct inode *directory_
    	iget_failed(ecryptfs_inode);
    	goto out;
    }
-	unlock_new_inode(ecryptfs_inode);
-	d_instantiate(ecryptfs_dentry, ecryptfs_inode);
+	d_instantiate_new(ecryptfs_dentry, ecryptfs_inode);
 out:
    return rc;
 }
--- a/fs/ext2/namei.c
+++ b/fs/ext2/namei.c
@@ -40,8 +40,7 @@ static inline int ext2_add_nondir(struct
 {
    int err = ext2_add_link(dentry, inode);
    if (!err) {
-		unlock_new_inode(inode);
-		d_instantiate(dentry, inode);
+		d_instantiate_new(dentry, inode);
    	return 0;
    }
    inode_dec_link_count(inode);
@@ -268,8 +267,7 @@ static int ext2_mkdir(struct inode * dir
    if (err)
    	goto out_fail;
-	unlock_new_inode(inode);
-	d_instantiate(dentry, inode);
+	d_instantiate_new(dentry, inode);
 out:
    return err;
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -2442,8 +2442,7 @@ static int ext4_add_nondir(handle_t *han
    int err = ext4_add_entry(handle, dentry, inode);
    if (!err) {
    	ext4_mark_inode_dirty(handle, inode);
-		unlock_new_inode(inode);
-		d_instantiate(dentry, inode);
+		d_instantiate_new(dentry, inode);
    	return 0;
    }
    drop_nlink(inode);
@@ -2682,8 +2681,7 @@ out_clear_inode:
    err = ext4_mark_inode_dirty(handle, dir);
    if (err)
    	goto out_clear_inode;
-	unlock_new_inode(inode);
-	d_instantiate(dentry, inode);
+	d_instantiate_new(dentry, inode);
    if (IS_DIRSYNC(dir))
    	ext4_handle_sync(handle);
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -158,8 +158,7 @@ static int f2fs_create(struct inode *dir
alloc_nid_done(sbi, ino);
-	d_instantiate(dentry, inode);
-	unlock_new_inode(inode);
+	d_instantiate_new(dentry, inode);
if (IS_DIRSYNC(dir))
    	f2fs_sync_fs(sbi->sb, 1);
@@ -464,8 +463,7 @@ static int f2fs_symlink(struct inode *di
    err = page_symlink(inode, disk_link.name, disk_link.len);
err_out:
-	d_instantiate(dentry, inode);
-	unlock_new_inode(inode);
+	d_instantiate_new(dentry, inode);
/*
     * Let's flush symlink data in order to avoid broken symlink as much as
@@ -519,8 +517,7 @@ static int f2fs_mkdir(struct inode *dir,
alloc_nid_done(sbi, inode->i_ino);
-	d_instantiate(dentry, inode);
-	unlock_new_inode(inode);
+	d_instantiate_new(dentry, inode);
if (IS_DIRSYNC(dir))
    	f2fs_sync_fs(sbi->sb, 1);
@@ -564,8 +561,7 @@ static int f2fs_mknod(struct inode *dir,
alloc_nid_done(sbi, inode->i_ino);
-	d_instantiate(dentry, inode);
-	unlock_new_inode(inode);
+	d_instantiate_new(dentry, inode);
if (IS_DIRSYNC(dir))
    	f2fs_sync_fs(sbi->sb, 1);
--- a/fs/jffs2/dir.c
+++ b/fs/jffs2/dir.c
@@ -209,8 +209,7 @@ static int jffs2_create(struct inode *di
    	  __func__, inode->i_ino, inode->i_mode, inode->i_nlink,
    	  f->inocache->pino_nlink, inode->i_mapping->nrpages);
-	unlock_new_inode(inode);
-	d_instantiate(dentry, inode);
+	d_instantiate_new(dentry, inode);
    return 0;
fail:
@@ -430,8 +429,7 @@ static int jffs2_symlink (struct inode *
    mutex_unlock(&dir_f->sem);
    jffs2_complete_reservation(c);
-	unlock_new_inode(inode);
-	d_instantiate(dentry, inode);
+	d_instantiate_new(dentry, inode);
    return 0;
fail:
@@ -575,8 +573,7 @@ static int jffs2_mkdir (struct inode *di
    mutex_unlock(&dir_f->sem);
    jffs2_complete_reservation(c);
-	unlock_new_inode(inode);
-	d_instantiate(dentry, inode);
+	d_instantiate_new(dentry, inode);
    return 0;
fail:
@@ -747,8 +744,7 @@ static int jffs2_mknod (struct inode *di
    mutex_unlock(&dir_f->sem);
    jffs2_complete_reservation(c);
-	unlock_new_inode(inode);
-	d_instantiate(dentry, inode);
+	d_instantiate_new(dentry, inode);
    return 0;
fail:
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -178,8 +178,7 @@ static int jfs_create(struct inode *dip,
    	unlock_new_inode(ip);
    	iput(ip);
    } else {
-		unlock_new_inode(ip);
-		d_instantiate(dentry, ip);
+		d_instantiate_new(dentry, ip);
    }
out2:
@@ -313,8 +312,7 @@ static int jfs_mkdir(struct inode *dip,
    	unlock_new_inode(ip);
    	iput(ip);
    } else {
-		unlock_new_inode(ip);
-		d_instantiate(dentry, ip);
+		d_instantiate_new(dentry, ip);
    }
out2:
@@ -1059,8 +1057,7 @@ static int jfs_symlink(struct inode *dip
    	unlock_new_inode(ip);
    	iput(ip);
    } else {
-		unlock_new_inode(ip);
-		d_instantiate(dentry, ip);
+		d_instantiate_new(dentry, ip);
    }
out2:
@@ -1447,8 +1444,7 @@ static int jfs_mknod(struct inode *dir,
    	unlock_new_inode(ip);
    	iput(ip);
    } else {
-		unlock_new_inode(ip);
-		d_instantiate(dentry, ip);
+		d_instantiate_new(dentry, ip);
    }
out1:
--- a/fs/nilfs2/namei.c
+++ b/fs/nilfs2/namei.c
@@ -46,8 +46,7 @@ static inline int nilfs_add_nondir(struc
    int err = nilfs_add_link(dentry, inode);
if (!err) {
-		d_instantiate(dentry, inode);
-		unlock_new_inode(inode);
+		d_instantiate_new(dentry, inode);
    	return 0;
    }
    inode_dec_link_count(inode);
@@ -243,8 +242,7 @@ static int nilfs_mkdir(struct inode *dir
    	goto out_fail;
nilfs_mark_inode_dirty(inode);
-	d_instantiate(dentry, inode);
-	unlock_new_inode(inode);
+	d_instantiate_new(dentry, inode);
 out:
    if (!err)
    	err = nilfs_transaction_commit(dir->i_sb);
--- a/fs/orangefs/namei.c
+++ b/fs/orangefs/namei.c
@@ -70,8 +70,7 @@ static int orangefs_create(struct inode
    	     get_khandle_from_ino(inode),
    	     dentry);
-	d_instantiate(dentry, inode);
-	unlock_new_inode(inode);
+	d_instantiate_new(dentry, inode);
    orangefs_set_timeout(dentry);
    ORANGEFS_I(inode)->getattr_time = jiffies - 1;
@@ -318,8 +317,7 @@ static int orangefs_symlink(struct inode
    	     "Assigned symlink inode new number of %pU\n",
    	     get_khandle_from_ino(inode));
-	d_instantiate(dentry, inode);
-	unlock_new_inode(inode);
+	d_instantiate_new(dentry, inode);
    orangefs_set_timeout(dentry);
    ORANGEFS_I(inode)->getattr_time = jiffies - 1;
@@ -382,8 +380,7 @@ static int orangefs_mkdir(struct inode *
    	     "Assigned dir inode new number of %pU\n",
    	     get_khandle_from_ino(inode));
-	d_instantiate(dentry, inode);
-	unlock_new_inode(inode);
+	d_instantiate_new(dentry, inode);
    orangefs_set_timeout(dentry);
    ORANGEFS_I(inode)->getattr_time = jiffies - 1;
--- a/fs/reiserfs/namei.c
+++ b/fs/reiserfs/namei.c
@@ -687,8 +687,7 @@ static int reiserfs_create(struct inode
    reiserfs_update_inode_transaction(inode);
    reiserfs_update_inode_transaction(dir);
-	unlock_new_inode(inode);
-	d_instantiate(dentry, inode);
+	d_instantiate_new(dentry, inode);
    retval = journal_end(&th);
out_failed:
@@ -771,8 +770,7 @@ static int reiserfs_mknod(struct inode *
    	goto out_failed;
    }
-	unlock_new_inode(inode);
-	d_instantiate(dentry, inode);
+	d_instantiate_new(dentry, inode);
    retval = journal_end(&th);
out_failed:
@@ -871,8 +869,7 @@ static int reiserfs_mkdir(struct inode *
    /* the above add_entry did not update dir's stat data */
    reiserfs_update_sd(&th, dir);
-	unlock_new_inode(inode);
-	d_instantiate(dentry, inode);
+	d_instantiate_new(dentry, inode);
    retval = journal_end(&th);
 out_failed:
    reiserfs_write_unlock(dir->i_sb);
@@ -1187,8 +1184,7 @@ static int reiserfs_symlink(struct inode
    	goto out_failed;
    }
-	unlock_new_inode(inode);
-	d_instantiate(dentry, inode);
+	d_instantiate_new(dentry, inode);
    retval = journal_end(&th);
 out_failed:
    reiserfs_write_unlock(parent_dir->i_sb);
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -621,8 +621,7 @@ static int udf_add_nondir(struct dentry
    if (fibh.sbh != fibh.ebh)
    	brelse(fibh.ebh);
    brelse(fibh.sbh);
-	unlock_new_inode(inode);
-	d_instantiate(dentry, inode);
+	d_instantiate_new(dentry, inode);
return 0;
 }
@@ -732,8 +731,7 @@ static int udf_mkdir(struct inode *dir,
    inc_nlink(dir);
    dir->i_ctime = dir->i_mtime = current_time(dir);
    mark_inode_dirty(dir);
-	unlock_new_inode(inode);
-	d_instantiate(dentry, inode);
+	d_instantiate_new(dentry, inode);
    if (fibh.sbh != fibh.ebh)
    	brelse(fibh.ebh);
    brelse(fibh.sbh);
--- a/fs/ufs/namei.c
+++ b/fs/ufs/namei.c
@@ -38,8 +38,7 @@ static inline int ufs_add_nondir(struct
 {
    int err = ufs_add_link(dentry, inode);
    if (!err) {
-		unlock_new_inode(inode);
-		d_instantiate(dentry, inode);
+		d_instantiate_new(dentry, inode);
    	return 0;
    }
    inode_dec_link_count(inode);
@@ -192,8 +191,7 @@ static int ufs_mkdir(struct inode * dir,
    if (err)
    	goto out_fail;
-	unlock_new_inode(inode);
-	d_instantiate(dentry, inode);
+	d_instantiate_new(dentry, inode);
    return 0;
out_fail:
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -219,6 +219,7 @@ extern seqlock_t rename_lock;
  * These are the low-level FS interfaces to the dcache..
  */
 extern void d_instantiate(struct dentry *, struct inode *);
+extern void d_instantiate_new(struct dentry *, struct inode *);
 extern struct dentry * d_instantiate_unique(struct dentry *, struct inode *);
 extern int d_instantiate_no_diralias(struct dentry *, struct inode *);
 extern void __d_drop(struct dentry *dentry);

    

2024

2023

2022

2021

2020

2019

2018

2017

[PATCH 4.9 008/329] do d_instantiate/unlock_new_inode combinations safely