hpfs: deadlock and race in directory lseek()
authorAl Viro <viro@zeniv.linux.org.uk>
Sat, 18 May 2013 06:38:52 +0000 (02:38 -0400)
committerAl Viro <viro@zeniv.linux.org.uk>
Fri, 31 May 2013 19:17:43 +0000 (15:17 -0400)
commit31abdab9c11bb1694ecd1476a7edbe8e964d94ac
tree3aeca5bc6bd3976552077909509e3a7e2be9542b
parent1d7095c72d35eee4ebc28e66563e636b9adafeb2
hpfs: deadlock and race in directory lseek()

For one thing, there's an ABBA deadlock on hpfs fs-wide lock and i_mutex
in hpfs_dir_lseek() - there's a lot of methods that grab the former with
the caller already holding the latter, so it must take i_mutex first.

For another, locking the damn thing, carefully validating the offset,
then dropping locks and assigning the offset is obviously racy.

Moreover, we _must_ do hpfs_add_pos(), or the machinery in dnode.c
won't modify the sucker on B-tree surgeries.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/hpfs/dir.c