mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git
synced 2026-10-28 12:53:14 +01:00
Christian Brauner
2d2a2d7aa9
iterate_supers_type() drops sb_lock while invoking the callback and keeps
only a passive reference to the current superblock. That reference keeps
the object allocated, but does not keep its s_instances node linked.
After the iterator releases s_umount, final teardown can unlink the current
s_instances node. The iterator then advances through a reinitialized node.
With the current hlist it stops without visiting the remaining superblocks.
The unlink moved from generic_shutdown_super() to kill_super_notify(), but
the cursor lifetime has been unsafe since the helper was introduced.
The CIFS DFS lookup can consequently miss a matching superblock and return
-EINVAL.
Move removal from fs_supers to put_super(), alongside removal from
super_blocks, so a passive reference keeps both list nodes linked. Keep
the filesystem module reference until then, since unlinking s_instances
may touch type->fs_supers.
Make sget_fc() skip SB_DEAD superblocks before invoking test(), and set
SB_DEAD under sb_lock to serialize with those callbacks. This allows
kernfs to free its private information after kill_anon_super() returns.
Keep matching SB_DYING superblocks until SB_DEAD is set so concurrent
mounts still wait for teardown before retrying.
Fixes: 43e15cdbef ("new helper: iterate_supers_type()")
Reported-by: Karl Mehltretter <[email protected]>
Closes: https://lore.kernel.org/r/[email protected]
Suggested-by: Jan Kara <[email protected]>
Cc: [email protected]
Tested-by: Karl Mehltretter <[email protected]>
[kmehltretter: supplied the commit message]
Signed-off-by: Karl Mehltretter <[email protected]>
Link: https://patch.msgid.link/[email protected]
Reviewed-by: Jan Kara <[email protected]>
Signed-off-by: Christian Brauner (Amutable) <[email protected]>