negative dentry_stat.nr_unused causes aggressive dcache pruning

[Steve Lord]

I have seen this stat go negative (just from booting up a multi cpu box),
and looking at the code, it is manipulated without locking in a number
of places. I have only seen this in real life on a 2.4 kernel, but 2.6
also looks vulnerable.

In 2.4 this can cause shrink_dcache_memory to attempt to push the whole
dcache out by calling prune_dcache with a negative parameter, prune_dcache
just keeps going until count hits zero or the dentry_unused list
empties.

In 2.6 kernels I do not see a real use of the variable which would cause harm,
although is someone was to start relying on more than -1 coming back from
shrink_dcache_memory there might be problems.

The problem code is dput which is the only place it is manipulated
without the dcache lock.

nr_dentry is not mp safe either, but no one depends on that.

Steve


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/