diff options
| author | Miklos Szeredi <mszeredi@redhat.com> | 2018-07-24 15:01:55 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-10-10 08:56:04 +0200 |
| commit | 90f06e1b81b9921290703aaf071aabb01f7ac012 (patch) | |
| tree | dd8baeca698028878f60cee138879887387b75e7 | |
| parent | d08d1bb535f40510709935f6ccc662c7e2c95c79 (diff) | |
| download | linux-90f06e1b81b9921290703aaf071aabb01f7ac012.tar.gz linux-90f06e1b81b9921290703aaf071aabb01f7ac012.tar.bz2 linux-90f06e1b81b9921290703aaf071aabb01f7ac012.zip | |
vfs: don't evict uninitialized inode
commit e950564b97fd0f541b02eb207685d0746f5ecf29 upstream.
iput() ends up calling ->evict() on new inode, which is not yet initialized
by owning fs. So use destroy_inode() instead.
Add to sb->s_inodes list only if inode is not in I_CREATING state (meaning
that it wasn't allocated with new_inode(), which already does the
insertion).
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes: 80ea09a002bf ("vfs: factor out inode_insert5()")
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/inode.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/fs/inode.c b/fs/inode.c index 56501fae5348..a06de4454232 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -1050,6 +1050,7 @@ struct inode *inode_insert5(struct inode *inode, unsigned long hashval, { struct hlist_head *head = inode_hashtable + hash(inode->i_sb, hashval); struct inode *old; + bool creating = inode->i_state & I_CREATING; again: spin_lock(&inode_hash_lock); @@ -1083,6 +1084,8 @@ again: inode->i_state |= I_NEW; hlist_add_head(&inode->i_hash, head); spin_unlock(&inode->i_lock); + if (!creating) + inode_sb_list_add(inode); unlock: spin_unlock(&inode_hash_lock); @@ -1117,12 +1120,13 @@ struct inode *iget5_locked(struct super_block *sb, unsigned long hashval, struct inode *inode = ilookup5(sb, hashval, test, data); if (!inode) { - struct inode *new = new_inode(sb); + struct inode *new = alloc_inode(sb); if (new) { + new->i_state = 0; inode = inode_insert5(new, hashval, test, set, data); if (unlikely(inode != new)) - iput(new); + destroy_inode(new); } } return inode; |