fix d_walk()/non-delayed __d_free() race

[pandora-kernel.git] / fs / dcache.c

diff --git a/fs/dcache.c b/fs/dcache.c
index 8bc98af..01c68ae 100644 (file)
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1016,13 +1016,13 @@ ascend:
                /* might go back up the wrong parent if we have had a rename */
                if (!locked && read_seqretry(&rename_lock, seq))
                        goto rename_retry;
-               next = child->d_child.next;
-               while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
+               /* go into the first sibling still alive */
+               do {
+                       next = child->d_child.next;
                        if (next == &this_parent->d_subdirs)
                                goto ascend;
                        child = list_entry(next, struct dentry, d_child);
-                       next = next->next;
-               }
+               } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
                rcu_read_unlock();
                goto resume;
        }
@@ -1142,13 +1142,13 @@ ascend:
                /* might go back up the wrong parent if we have had a rename */
                if (!locked && read_seqretry(&rename_lock, seq))
                        goto rename_retry;
-               next = child->d_child.next;
-               while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
+               /* go into the first sibling still alive */
+               do {
+                       next = child->d_child.next;
                        if (next == &this_parent->d_subdirs)
                                goto ascend;
                        child = list_entry(next, struct dentry, d_child);
-                       next = next->next;
-               }
+               } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
                rcu_read_unlock();
                goto resume;
        }
@@ -1261,7 +1261,7 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name)
        struct dentry *dentry = __d_alloc(parent->d_sb, name);
        if (!dentry)
                return NULL;
-
+       dentry->d_flags |= DCACHE_RCUACCESS;
        spin_lock(&parent->d_lock);
        /*
         * don't need child lock because it is not subject
@@ -2011,7 +2011,6 @@ static void __d_rehash(struct dentry * entry, struct hlist_bl_head *b)
 {
        BUG_ON(!d_unhashed(entry));
        hlist_bl_lock(b);
-       entry->d_flags |= DCACHE_RCUACCESS;
        hlist_bl_add_head_rcu(&entry->d_hash, b);
        hlist_bl_unlock(b);
 }
@@ -2195,6 +2194,7 @@ static void __d_move(struct dentry * dentry, struct dentry * target)
 
        /* ... and switch the parents */
        if (IS_ROOT(dentry)) {
+               dentry->d_flags |= DCACHE_RCUACCESS;
                dentry->d_parent = target->d_parent;
                target->d_parent = target;
                INIT_LIST_HEAD(&target->d_child);
@@ -2311,6 +2311,7 @@ static void __d_materialise_dentry(struct dentry *dentry, struct dentry *anon)
        switch_names(dentry, anon);
        swap(dentry->d_name.hash, anon->d_name.hash);
 
+       dentry->d_flags |= DCACHE_RCUACCESS;
        dentry->d_parent = (aparent == anon) ? dentry : aparent;
        list_del(&dentry->d_child);
        if (!IS_ROOT(dentry))
@@ -2452,6 +2453,8 @@ static int prepend_path(const struct path *path,
 {
        struct dentry *dentry = path->dentry;
        struct vfsmount *vfsmnt = path->mnt;
+       char *orig_buffer = *buffer;
+       int orig_len = *buflen;
        bool slash = false;
        int error = 0;
 
@@ -2459,6 +2462,14 @@ static int prepend_path(const struct path *path,
                struct dentry * parent;
 
                if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
+                       /* Escaped? */
+                       if (dentry != vfsmnt->mnt_root) {
+                               *buffer = orig_buffer;
+                               *buflen = orig_len;
+                               slash = false;
+                               error = 3;
+                               goto global_root;
+                       }
                        /* Global root? */
                        if (vfsmnt->mnt_parent == vfsmnt) {
                                goto global_root;
@@ -2938,13 +2949,13 @@ ascend:
                /* might go back up the wrong parent if we have had a rename */
                if (!locked && read_seqretry(&rename_lock, seq))
                        goto rename_retry;
-               next = child->d_child.next;
-               while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
+               /* go into the first sibling still alive */
+               do {
+                       next = child->d_child.next;
                        if (next == &this_parent->d_subdirs)
                                goto ascend;
                        child = list_entry(next, struct dentry, d_child);
-                       next = next->next;
-               }
+               } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
                rcu_read_unlock();
                goto resume;
        }