tree 9235d52e214601db74141451460fe8a915ffa0c3
parent fcad93360df4d04b172dba85b976c9f38ee0d5e0
author Mateusz Guzik <mjguzik@gmail.com> 1721315917 +0200
committer Christian Brauner <brauner@kernel.org> 1721811178 +0200
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCZqDA8AAKCRCRxhvAZXjc
 ouQmAQDT5mKHrFVnol1X0eGHAhwcagR/qp66irgORn+gkPaiNwD+MzYupDDrh48x
 YKQW+xpeEqkcdNE/afSu8AGjWR+kWQ0=
 =CtPM
 -----END PGP SIGNATURE-----

vfs: handle __wait_on_freeing_inode() and evict() race

Lockless hash lookup can find and lock the inode after it gets the
I_FREEING flag set, at which point it blocks waiting for teardown in
evict() to finish.

However, the flag is still set even after evict() wakes up all waiters.

This results in a race where if the inode lock is taken late enough, it
can happen after both hash removal and wakeups, meaning there is nobody
to wake the racing thread up.

This worked prior to RCU-based lookup because the entire ordeal was
synchronized with the inode hash lock.

Since unhashing requires the inode lock, we can safely check whether it
happened after acquiring it.

Link: https://lore.kernel.org/v9fs/20240717102458.649b60be@kernel.org/
Reported-by: Dominique Martinet <asmadeus@codewreck.org>
Fixes: 7180f8d91fcb ("vfs: add rcu-based find_inode variants for iget ops")
Signed-off-by: Mateusz Guzik <mjguzik@gmail.com>
Link: https://lore.kernel.org/r/20240718151838.611807-1-mjguzik@gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>