lkml.org 
[lkml]   [2007]   [Sep]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Race in the inotify debug code
    > On Thu, 23 Aug 2007 11:25:18 -0400 Chuck Ebbert <cebbert@redhat.com> wrote:
    > https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=248355
    >
    > Description of problem:
    > Warnings in the kernel log (dmesg):
    > BUG: warning at fs/inotify.c:172/set_dentry_child_flags() (Not tainted)
    > [<c0497a37>] set_dentry_child_flags+0x67/0x13d
    > [<c0497c27>] remove_watch_no_event+0x2f/0x3b
    > [<c0497d15>] inotify_remove_watch_locked+0x12/0x3e
    > [<c0600c17>] mutex_lock+0x1a/0x29
    > [<c0497fdd>] inotify_rm_wd+0x6d/0x8a
    > [<c04983b1>] sys_inotify_rm_watch+0x38/0x4f
    > [<c0404f70>] syscall_call+0x7/0xb
    >
    > Appears randomly, about every second/third day.
    >
    > Still happening in kernel 2.6.22.
    >
    >
    > static void set_dentry_child_flags(struct inode *inode, int watched)
    > ...
    > spin_lock(&dcache_lock);
    > list_for_each_entry(alias, &inode->i_dentry, d_alias) {
    > struct dentry *child;
    >
    > list_for_each_entry(child, &alias->d_subdirs, d_u.d_child) {
    > if (!child->d_inode) {
    > WARN_ON(child->d_flags & DCACHE_INOTIFY_PARENT_WATCHED);
    > continue;
    > }
    >
    > But in dcache.c, the locks are dropped before this flag is cleared, leaving
    > a race window:
    >
    > void d_delete(struct dentry * dentry)
    > ...
    > spin_lock(&dcache_lock);
    > spin_lock(&dentry->d_lock);
    > isdir = S_ISDIR(dentry->d_inode->i_mode);
    > if (atomic_read(&dentry->d_count) == 1) {
    > dentry_iput(dentry); <================ drops dcache_lock and dentry->d_lock
    > fsnotify_nameremove(dentry, isdir);
    >
    > /* remove this and other inotify debug checks after 2.6.18 */
    > dentry->d_flags &= ~DCACHE_INOTIFY_PARENT_WATCHED;
    > return;
    > }
    >
    > (The comment is nice, it says the debug code should have been removed long ago.)

    We've been chasing this bug for a year or so. Thanks for maybe-solving it.
    I forwarded your email to Nick a few days ago but he's presently tied up
    with kernel slummit. Please let us not forget about this?
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-09-05 18:09    [W:3.024 / U:2.652 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site