Commit 3d36e57f authored by Andreas Gruenbacher's avatar Andreas Gruenbacher
Browse files

gfs2: gfs2_create_inode rework 



When gfs2_lookup_by_inum() calls gfs2_inode_lookup() for an uncached
inode, gfs2_inode_lookup() will place a new tentative inode into the
inode cache before verifying that there is a valid inode at the given
address.  This can race with gfs2_create_inode() which doesn't check for
duplicates inodes.  gfs2_create_inode() will try to assign the new inode
to the corresponding inode glock, and glock_set_object() will complain
that the glock is still in use by gfs2_inode_lookup's tentative inode.

We noticed this bug after adding commit 486408d6 ("gfs2: Cancel
remote delete work asynchronously") which allowed delete_work_func() to
race with gfs2_create_inode(), but the same race exists for
open-by-handle.

Fix that by switching from insert_inode_hash() to
insert_inode_locked4(), which does check for duplicate inodes.  We know
we've just managed to to allocate the new inode, so an inode tentatively
created by gfs2_inode_lookup() will eventually go away and
insert_inode_locked4() will always succeed.

In addition, don't flush the inode glock work anymore (this can now only
make things worse) and clean up glock_{set,clear}_object for the inode
glock somewhat.

Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
parent 5f6e13ba

fs/gfs2/inode.c

+10 −6
Original line number Diff line number Diff line
@@ -707,18 +707,19 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry, 
	error = gfs2_glock_get(sdp, ip->i_no_addr, &gfs2_inode_glops, CREATE, &ip->i_gl);

	if (error)

		goto fail_free_inode;

	flush_delayed_work(&ip->i_gl->gl_work);



	error = gfs2_glock_get(sdp, ip->i_no_addr, &gfs2_iopen_glops, CREATE, &io_gl);

	if (error)

		goto fail_free_inode;

	gfs2_cancel_delete_work(io_gl);



	error = insert_inode_locked4(inode, ip->i_no_addr, iget_test, &ip->i_no_addr);

	BUG_ON(error);



	error = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, GL_SKIP, ghs + 1);

	if (error)

		goto fail_gunlock2;



	glock_set_object(ip->i_gl, ip);

	error = gfs2_trans_begin(sdp, blocks, 0);

	if (error)

		goto fail_gunlock2;
@@ -734,9 +735,9 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry, 
	if (error)

		goto fail_gunlock2;



	glock_set_object(ip->i_gl, ip);

	glock_set_object(io_gl, ip);

	gfs2_set_iop(inode);

	insert_inode_hash(inode);



	free_vfs_inode = 0; /* After this point, the inode is no longer

			       considered free. Any failures need to undo
@@ -778,17 +779,17 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry, 
	gfs2_glock_dq_uninit(ghs + 1);

	gfs2_glock_put(io_gl);

	gfs2_qa_put(dip);

	unlock_new_inode(inode);

	return error;



fail_gunlock3:

	glock_clear_object(ip->i_gl, ip);

	glock_clear_object(io_gl, ip);

	gfs2_glock_dq_uninit(&ip->i_iopen_gh);

fail_gunlock2:

	glock_clear_object(io_gl, ip);

	gfs2_glock_put(io_gl);

fail_free_inode:

	if (ip->i_gl) {

		glock_clear_object(ip->i_gl, ip);

		if (free_vfs_inode) /* else evict will do the put for us */

			gfs2_glock_put(ip->i_gl);

	}
@@ -806,6 +807,9 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry, 
			mark_inode_dirty(inode);

		set_bit(free_vfs_inode ? GIF_FREE_VFS_INODE : GIF_ALLOC_FAILED,

			&GFS2_I(inode)->i_flags);

		if (inode->i_state & I_NEW)

			iget_failed(inode);

		else

			iput(inode);

	}

	if (gfs2_holder_initialized(ghs + 1))