fix race in d_splice_alias()
authorAl Viro <viro@zeniv.linux.org.uk>
Wed, 3 Mar 2010 19:13:08 +0000 (14:13 -0500)
committerAl Viro <viro@zeniv.linux.org.uk>
Wed, 3 Mar 2010 19:13:08 +0000 (14:13 -0500)
rehashing the negative placeholder opens a race with d_lookup();
we unhash it almost immediately (by d_move()), but the race
window is there.  Since d_move() doesn't rely on target being
hashed, we don't need that d_rehash() at all.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/dcache.c

index 74da947b160bf3f6a7eae7cb5b56b82465d80c4e..f1358e5c3a59b3b5f2551980956f84e09355378e 100644 (file)
@@ -1222,7 +1222,6 @@ struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry)
                        BUG_ON(!(new->d_flags & DCACHE_DISCONNECTED));
                        spin_unlock(&dcache_lock);
                        security_d_instantiate(new, inode);
-                       d_rehash(dentry);
                        d_move(new, dentry);
                        iput(inode);
                } else {