lkml.org 
[lkml]   [2008]   [Feb]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 09/30] r/o bind mounts: drop write during emergency remount
On Mon, Feb 18, 2008 at 05:29:15PM +0100, Miklos Szeredi wrote:
> > file_list_lock();
> > list_for_each_entry(f, &sb->s_files, f_u.fu_list) {
> > - if (S_ISREG(f->f_path.dentry->d_inode->i_mode) && file_count(f))
> > - f->f_mode &= ~FMODE_WRITE;
> > + struct vfsmount *mnt;
> > + if (!S_ISREG(f->f_path.dentry->d_inode->i_mode))
> > + continue;
> > + if (!file_count(f))
> > + continue;
> > + if (!(f->f_mode & FMODE_WRITE))
> > + continue;
> > + f->f_mode &= ~FMODE_WRITE;
> > + mnt = f->f_path.mnt;
>
> AFAICS an mntget() is needed here to make sure mnt doesn't go away
> after releasing file_list_lock.

Good catch, but... that's not all. We also have to move
drop_file_write_access() in __fput() past the file_kill(), or we'll
get a race here - CPU 1 enters that loop, sees ->f_count 1, checks
that file is writable, CPU 2 does final fput() and proceeds to
do drop_file_write_access() and mnt_drop_write(). CPU 1, in the
meanwhile, removes FMODE_WRITE and goes on to do mnt_drop_write()
itself.

Oh, well... Fixed.


\
 
 \ /
  Last update: 2008-02-23 14:41    [W:0.050 / U:1.764 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site