From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 3 Mar 2010 19:13:08 +0000 (-0500)
Subject: fix race in d_splice_alias()
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=4919c5e45a91b5db5a41695fe0357fbdff0d5767;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

fix race in d_splice_alias()

rehashing the negative placeholder opens a race with d_lookup();
we unhash it almost immediately (by d_move()), but the race
window is there.  Since d_move() doesn't rely on target being
hashed, we don't need that d_rehash() at all.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---

diff --git a/fs/dcache.c b/fs/dcache.c
index 74da947b160b..f1358e5c3a59 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1222,7 +1222,6 @@ struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry)
 			BUG_ON(!(new->d_flags & DCACHE_DISCONNECTED));
 			spin_unlock(&dcache_lock);
 			security_d_instantiate(new, inode);
-			d_rehash(dentry);
 			d_move(new, dentry);
 			iput(inode);
 		} else {