Re: Linux 2.6.38-rc5

[Linus Torvalds]

On Wed, Feb 16, 2011 at 3:14 AM, Eric Dumazet <eric.dumazet@xxxxxxxxx> wrote:
>
> Using this kernel on my dev machine (2x4x2 cpus), I hit BUG_ON() in
> fs/namei.c:1461 on my kernel build (make -j16)

Uhhuh. We replaced one BUG_ON() with another.

And I think it's a really silly problem too: when Al moved the

        /* We drop rcu-walk here */
        if (nameidata_dentry_drop_rcu_maybe(nd, path->dentry))
                return -ECHILD;

test into do_follow_link(), he _should_ have moved the BUG_ON() in
there too, methinks. He didn't, and as a result the BUG_ON() is now
before the "drop_rcu_maybe".

This patch should fix it. Al? Comments?

(Of course, we could just remove the BUG_ON() entirely, but
considering that this is still fragile new code I'd rather leave it
in)

                               Linus
 fs/namei.c |    9 ++++-----
 1 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/fs/namei.c b/fs/namei.c
index 9e701e2..0087cf9 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -795,7 +795,7 @@ __do_follow_link(const struct path *link, struct nameidata *nd, void **p)
  * Without that kind of total limit, nasty chains of consecutive
  * symlinks can cause almost arbitrarily long lookups. 
  */
-static inline int do_follow_link(struct path *path, struct nameidata *nd)
+static inline int do_follow_link(struct inode *inode, struct path *path, struct nameidata *nd)
 {
 	void *cookie;
 	int err = -ELOOP;
@@ -803,6 +803,7 @@ static inline int do_follow_link(struct path *path, struct nameidata *nd)
 	/* We drop rcu-walk here */
 	if (nameidata_dentry_drop_rcu_maybe(nd, path->dentry))
 		return -ECHILD;
+	BUG_ON(inode != path->dentry->d_inode);
 
 	if (current->link_count >= MAX_NESTED_LINKS)
 		goto loop;
@@ -1413,8 +1414,7 @@ exec_again:
 			goto out_dput;
 
 		if (inode->i_op->follow_link) {
-			BUG_ON(inode != next.dentry->d_inode);
-			err = do_follow_link(&next, nd);
+			err = do_follow_link(inode, &next, nd);
 			if (err)
 				goto return_err;
 			nd->inode = nd->path.dentry->d_inode;
@@ -1458,8 +1458,7 @@ last_component:
 			break;
 		if (inode && unlikely(inode->i_op->follow_link) &&
 		    (lookup_flags & LOOKUP_FOLLOW)) {
-			BUG_ON(inode != next.dentry->d_inode);
-			err = do_follow_link(&next, nd);
+			err = do_follow_link(inode, &next, nd);
 			if (err)
 				goto return_err;
 			nd->inode = nd->path.dentry->d_inode;