From: Eric Sandeen <sandeen@redhat.com> Subject: [PATCH RHEL5] return ENOENT from ext3_link when racing with unlink Date: Wed, 24 Jan 2007 10:11:02 -0600 Bugzilla: 219650 Message-Id: <45B78516.80606@redhat.com> Changelog: [ext3] return ENOENT from ext3_link when racing with unlink RHEL5 version. For Bugzilla Bug 219650: [RHEL5 BETA2] EXT3 s_orphan list not updated for freed inode when inode->i_nlink This is in the -mm tree now. Return -ENOENT from ext[34]_link if we've raced with unlink and i_nlink is 0. Doing otherwise has the potential to corrupt the orphan inode list, because we'd wind up with an inode with a non-zero link count on the list, and it will never get properly cleaned up & removed from the orphan list before it is freed. Signed-off-by: Eric Sandeen <sandeen@redhat.com> Cc: <linux-ext4@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@osdl.org> --- Index: linux-2.6.18-1.2910.el5/fs/ext3/namei.c =================================================================== --- linux-2.6.18-1.2910.el5.orig/fs/ext3/namei.c +++ linux-2.6.18-1.2910.el5/fs/ext3/namei.c @@ -2190,6 +2190,12 @@ static int ext3_link (struct dentry * ol if (inode->i_nlink >= EXT3_LINK_MAX) return -EMLINK; + /* + * Return -ENOENT if we've raced with unlink and i_nlink is 0. Doing + * otherwise has the potential to corrupt the orphan inode list. + */ + if (inode->i_nlink == 0) + return -ENOENT; retry: handle = ext3_journal_start(dir, EXT3_DATA_TRANS_BLOCKS(dir->i_sb) +