Re: Race condition between iget_locked() and evict_inodes()

On Thu, Sep 29, 2016 at 12:56:49PM +, Anton Altaparmakov wrote: > Hi Al, > > > On 29 Sep 2016, at 13:17, Al Viro wrote: > > > > On Thu, Sep 29, 2016 at 11:53:21AM +, Anton Altaparmakov wrote: > >> Thus if the events happen in this order: > >> > >>

Re: Race condition between iget_locked() and evict_inodes()

On Thu, Sep 29, 2016 at 12:56:49PM +, Anton Altaparmakov wrote: > Hi Al, > > > On 29 Sep 2016, at 13:17, Al Viro wrote: > > > > On Thu, Sep 29, 2016 at 11:53:21AM +, Anton Altaparmakov wrote: > >> Thus if the events happen in this order: > >> > >> evict_inodes()

Re: Race condition between iget_locked() and evict_inodes()

Hi Al, > On 29 Sep 2016, at 13:17, Al Viro wrote: > > On Thu, Sep 29, 2016 at 11:53:21AM +, Anton Altaparmakov wrote: >> Thus if the events happen in this order: >> >> evict_inodes() iget_locked() in >> find_inode_fast() > > ... you

Re: Race condition between iget_locked() and evict_inodes()

Hi Al, > On 29 Sep 2016, at 13:17, Al Viro wrote: > > On Thu, Sep 29, 2016 at 11:53:21AM +, Anton Altaparmakov wrote: >> Thus if the events happen in this order: >> >> evict_inodes() iget_locked() in >> find_inode_fast() > > ... you are buggered, because

Re: Race condition between iget_locked() and evict_inodes()

On Thu, Sep 29, 2016 at 11:53:21AM +, Anton Altaparmakov wrote: > Thus if the events happen in this order: > > evict_inodes()iget_locked() in > find_inode_fast() ... you are buggered, because somebody is trying to grab a reference to inode on a filesystem

Re: Race condition between iget_locked() and evict_inodes()

On Thu, Sep 29, 2016 at 11:53:21AM +, Anton Altaparmakov wrote: > Thus if the events happen in this order: > > evict_inodes()iget_locked() in > find_inode_fast() ... you are buggered, because somebody is trying to grab a reference to inode on a filesystem

Race condition between iget_locked() and evict_inodes()

Hi Al, I think there is a race condition between iget_locked() and evict_inodes(). evict_inodes() checks i_count and if zero proceeds to take i_lock then set I_FREEING and eventually disposes of the inode. But a concurrent iget_locked() takes i_lock and then increments i_count. Thus

Race condition between iget_locked() and evict_inodes()

Hi Al, I think there is a race condition between iget_locked() and evict_inodes(). evict_inodes() checks i_count and if zero proceeds to take i_lock then set I_FREEING and eventually disposes of the inode. But a concurrent iget_locked() takes i_lock and then increments i_count. Thus