fs/dcache: d_add_ci() needs to complete parallel lookup.
Result of d_alloc_parallel() in d_add_ci() is fed to d_splice_alias(), which *NORMALLY* feeds it to __d_add() or __d_move() in a way that will have __d_lookup_done() applied to it. However, there is a nasty possibility - d_splice_alias() might legitimately fail without having marked the sucker not in-lookup. dentry will get dropped by d_add_ci(), so ->d_wait won't end up pointing to freed object, but it's still a bug - retain_dentry() will scream bloody murder upon seeing that, and for a good reason; we'll get hash chain corrupted. It's impossible to hit without corrupted fs image (ntfs or case-insensitive xfs), but it's a bug. Invoke d_lookup_done() after d_splice_alias() to ensure that the in-lookip flag is always cleared. Fixes: d9171b93 ("parallel lookups machinery, part 4 (and last)") Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Please register or sign in to comment