udf: fix the udf_iget() vs. udf_new_inode() races
authorAl Viro <viro@zeniv.linux.org.uk>
Thu, 4 Sep 2014 13:38:11 +0000 (09:38 -0400)
committerJan Kara <jack@suse.cz>
Thu, 4 Sep 2014 19:37:41 +0000 (21:37 +0200)
Currently udf_iget() (triggered by NFS) can race with udf_new_inode()
leading to two inode structures with the same inode number:

nfsd: iget_locked() creates inode
nfsd: try to read from disk, block on that.
udf_new_inode(): allocate inode with that inumber
udf_new_inode(): insert it into icache, set it up and dirty
udf_write_inode(): write inode into buffer cache
nfsd: get CPU again, look into buffer cache, see nice and sane on-disk
  inode, set the in-core inode from it

Fix the problem by putting inode into icache in locked state (I_NEW set)
and unlocking it only after it's fully set up.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jan Kara <jack@suse.cz>
fs/udf/ialloc.c
fs/udf/namei.c

diff --cc fs/udf/ialloc.c
Simple merge
diff --cc fs/udf/namei.c
Simple merge