Re: Race condition between iget_locked() and evict_inodes()

[Al Viro]

On Thu, Sep 29, 2016 at 12:56:49PM +0000, Anton Altaparmakov wrote:
> Hi Al,
> 
> > On 29 Sep 2016, at 13:17, Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote:
> > 
> > On Thu, Sep 29, 2016 at 11:53:21AM +0000, Anton Altaparmakov wrote:
> >> Thus if the events happen in this order:
> >> 
> >> evict_inodes()				iget_locked() in find_inode_fast()
> > 
> > ... you are buggered, because somebody is trying to grab a reference
> > to inode on a filesystem that is being shut down.  Look at evict_inode()
> > caller...
> 
> But what if that somebody is simply the file system being shutdown trying to flush some dirty metadata to disk which is stored in a file and thus accessed via an inode and thus iget on the inode is needed?  Surely that is allowed even during shutdown.  Once the write is complete iput() is called which then immediately evicts the inode as MS_ACTIVE is clear...

If it's a per-superblock inode, just keep it referenced until ->put_super()
and be done with that.  Besides, the caller has just done sync_filesystem()
there, so any dirty metadata would better be already flushed.