Unverified Commit be97a4b6 authored by Mateusz Guzik's avatar Mateusz Guzik Committed by Christian Brauner
Browse files

fs: assert on ->i_count in iput_final() 



Notably make sure the count is 0 after the return from ->drop_inode(),
provided we are going to drop.

Inspired by suspicious games played by f2fs.

Signed-off-by: default avatarMateusz Guzik <mjguzik@gmail.com>
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent dc816f8d

fs/inode.c

+7 −0
Original line number Diff line number Diff line
@@ -1879,6 +1879,7 @@ static void iput_final(struct inode *inode) 
	int drop;



	WARN_ON(inode->i_state & I_NEW);

	VFS_BUG_ON_INODE(atomic_read(&inode->i_count) != 0, inode);



	if (op->drop_inode)

		drop = op->drop_inode(inode);
@@ -1893,6 +1894,12 @@ static void iput_final(struct inode *inode) 
		return;

	}



	/*

	 * Re-check ->i_count in case the ->drop_inode() hooks played games.

	 * Note we only execute this if the verdict was to drop the inode.

	 */

	VFS_BUG_ON_INODE(atomic_read(&inode->i_count) != 0, inode);



	state = inode->i_state;

	if (!drop) {

		WRITE_ONCE(inode->i_state, state | I_WILL_FREE);