Fix the lack of locking around modifications of net->cells_dyn_ino. Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand") Closes: https://sashiko.dev/#/patchset/20260618074903.2374756-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org --- fs/afs/cell.c | 8 +++++++- fs/afs/internal.h | 1 + fs/afs/main.c | 1 + 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/fs/afs/cell.c b/fs/afs/cell.c index fbb8a43aa7cd..e95e96f8200c 100644 --- a/fs/afs/cell.c +++ b/fs/afs/cell.c @@ -205,8 +205,12 @@ static struct afs_cell *afs_alloc_cell(struct afs_net *net, cell->dns_source = vllist->source; cell->dns_status = vllist->status; smp_store_release(&cell->dns_lookup_count, 1); /* vs source/status */ + idr_preload(GFP_KERNEL); + spin_lock(&net->cells_dyn_ino_lock); ret = idr_alloc_cyclic(&net->cells_dyn_ino, cell, - 2, INT_MAX / 2, GFP_KERNEL); + 2, INT_MAX / 2, GFP_ATOMIC); + spin_unlock(&net->cells_dyn_ino_lock); + idr_preload_end(); if (ret < 0) goto error; atomic_inc(&net->cells_outstanding); @@ -579,7 +583,9 @@ static void afs_cell_destroy(struct rcu_head *rcu) afs_put_vlserverlist(net, rcu_access_pointer(cell->vl_servers)); afs_unuse_cell(cell->alias_of, afs_cell_trace_unuse_alias); key_put(cell->anonymous_key); + spin_lock(&net->cells_dyn_ino_lock); idr_remove(&net->cells_dyn_ino, cell->dynroot_ino); + spin_unlock(&net->cells_dyn_ino_lock); kfree(cell->name - 1); kfree(cell); diff --git a/fs/afs/internal.h b/fs/afs/internal.h index 785c646856d7..c42752608383 100644 --- a/fs/afs/internal.h +++ b/fs/afs/internal.h @@ -293,6 +293,7 @@ struct afs_net { struct idr cells_dyn_ino; /* cell->dynroot_ino mapping */ struct afs_cell __rcu *ws_cell; atomic_t cells_outstanding; + spinlock_t cells_dyn_ino_lock; struct rw_semaphore cells_lock; struct mutex cells_alias_lock; diff --git a/fs/afs/main.c b/fs/afs/main.c index 7a883c59976f..0a4a606575d7 100644 --- a/fs/afs/main.c +++ b/fs/afs/main.c @@ -78,6 +78,7 @@ static int __net_init afs_net_init(struct net *net_ns) net->cells = RB_ROOT; idr_init(&net->cells_dyn_ino); + spin_lock_init(&net->cells_dyn_ino_lock); init_rwsem(&net->cells_lock); mutex_init(&net->cells_alias_lock); mutex_init(&net->proc_cells_lock);