Messages in this thread | | | Date | Sat, 23 Feb 2008 13:38:54 +0000 | From | Al Viro <> | Subject | Re: [PATCH 09/30] r/o bind mounts: drop write during emergency remount |
| |
On Mon, Feb 18, 2008 at 05:29:15PM +0100, Miklos Szeredi wrote: > > file_list_lock(); > > list_for_each_entry(f, &sb->s_files, f_u.fu_list) { > > - if (S_ISREG(f->f_path.dentry->d_inode->i_mode) && file_count(f)) > > - f->f_mode &= ~FMODE_WRITE; > > + struct vfsmount *mnt; > > + if (!S_ISREG(f->f_path.dentry->d_inode->i_mode)) > > + continue; > > + if (!file_count(f)) > > + continue; > > + if (!(f->f_mode & FMODE_WRITE)) > > + continue; > > + f->f_mode &= ~FMODE_WRITE; > > + mnt = f->f_path.mnt; > > AFAICS an mntget() is needed here to make sure mnt doesn't go away > after releasing file_list_lock.
Good catch, but... that's not all. We also have to move drop_file_write_access() in __fput() past the file_kill(), or we'll get a race here - CPU 1 enters that loop, sees ->f_count 1, checks that file is writable, CPU 2 does final fput() and proceeds to do drop_file_write_access() and mnt_drop_write(). CPU 1, in the meanwhile, removes FMODE_WRITE and goes on to do mnt_drop_write() itself.
Oh, well... Fixed.
| |