From a91d48fd9bc7113269bea0e1ec051fc42a9a6fa0 Mon Sep 17 00:00:00 2001 From: kib Date: Fri, 22 Aug 2014 07:09:54 +0000 Subject: [PATCH] MFC r269708: Unlock ldvp and lock dvp to compensate for possible ldvp unlock in lower VOP_LOOKUP() and dvp reclamation. Use cached value of dvp->v_mount. git-svn-id: svn://svn.freebsd.org/base/stable/10@270319 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sys/fs/nullfs/null_vnops.c | 44 ++++++++++++++++++++++++++++++++++---- 1 file changed, 40 insertions(+), 4 deletions(-) diff --git a/sys/fs/nullfs/null_vnops.c b/sys/fs/nullfs/null_vnops.c index 481644cf8..4762a3c86 100644 --- a/sys/fs/nullfs/null_vnops.c +++ b/sys/fs/nullfs/null_vnops.c @@ -361,9 +361,11 @@ null_lookup(struct vop_lookup_args *ap) struct vnode *dvp = ap->a_dvp; int flags = cnp->cn_flags; struct vnode *vp, *ldvp, *lvp; + struct mount *mp; int error; - if ((flags & ISLASTCN) && (dvp->v_mount->mnt_flag & MNT_RDONLY) && + mp = dvp->v_mount; + if ((flags & ISLASTCN) != 0 && (mp->mnt_flag & MNT_RDONLY) != 0 && (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) return (EROFS); /* @@ -376,9 +378,43 @@ null_lookup(struct vop_lookup_args *ap) ((dvp->v_vflag & VV_ROOT) != 0 && (flags & ISDOTDOT) == 0), ("ldvp %p fl %#x dvp %p fl %#x flags %#x", ldvp, ldvp->v_vflag, dvp, dvp->v_vflag, flags)); + + /* + * Hold ldvp. The reference on it, owned by dvp, is lost in + * case of dvp reclamation, and we need ldvp to move our lock + * from ldvp to dvp. + */ + vhold(ldvp); + error = VOP_LOOKUP(ldvp, &lvp, cnp); - if (error == EJUSTRETURN && (flags & ISLASTCN) && - (dvp->v_mount->mnt_flag & MNT_RDONLY) && + + /* + * VOP_LOOKUP() on lower vnode may unlock ldvp, which allows + * dvp to be reclaimed due to shared v_vnlock. Check for the + * doomed state and return error. + */ + if ((error == 0 || error == EJUSTRETURN) && + (dvp->v_iflag & VI_DOOMED) != 0) { + error = ENOENT; + if (lvp != NULL) + vput(lvp); + + /* + * If vgone() did reclaimed dvp before curthread + * relocked ldvp, the locks of dvp and ldpv are no + * longer shared. In this case, relock of ldvp in + * lower fs VOP_LOOKUP() does not restore the locking + * state of dvp. Compensate for this by unlocking + * ldvp and locking dvp, which is also correct if the + * locks are still shared. + */ + VOP_UNLOCK(ldvp, 0); + vn_lock(dvp, LK_EXCLUSIVE | LK_RETRY); + } + vdrop(ldvp); + + if (error == EJUSTRETURN && (flags & ISLASTCN) != 0 && + (mp->mnt_flag & MNT_RDONLY) != 0 && (cnp->cn_nameiop == CREATE || cnp->cn_nameiop == RENAME)) error = EROFS; @@ -388,7 +424,7 @@ null_lookup(struct vop_lookup_args *ap) VREF(dvp); vrele(lvp); } else { - error = null_nodeget(dvp->v_mount, lvp, &vp); + error = null_nodeget(mp, lvp, &vp); if (error == 0) *ap->a_vpp = vp; } -- 2.45.0