[Devel] [PATCH RHEL7 COMMIT] pfcache: fix path refcounting hazzard

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-123.1.2-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-123.1.2.vz7.5.11
------>
commit 550d5a198e5b687ba27d2c8f6e56409e31ba7b89
Author: Dmitry Monakhov <dmonakhov at openvz.org>
Date:   Tue Jun 9 12:59:39 2015 +0400

    pfcache: fix path refcounting hazzard
    
    peer's path management was broken during porting from rhel6 to rhel7
    
    - open_mapping_peer no longer responsible for path drop on error.
    - fix refcounting during race peer_open/peer_close
    
    #TESTCASE:
    VEID=101
    mkdir /tmp/pfcache
    mount -ttmpfs none /tmp/pfcache
    vzctl create $VEID
    vzctl mount $VEID
    dd if=/dev/zero of=/vz/root/$VEID/bin/f1 bs=4k count=1
    cp /vz/root/$VEID/bin/f1 /pfcache/1c/eaf73df40e531df3bfb26b4fb7cd95fb7bff1d
    vzctl umount $VEID
    mount /vz/root/$VEID -oremount,balloon_ino=12,pfcache_csum,pfcache=/tmp/pfcache
    stat /vz/root/$VEID/bin/f1 | echo FAIL
    vzctl umount $VEID
    umount /tmp/pfcache || echo FAIL
    
    Signed-off-by: Dmitry Monakhov <dmonakhov at openvz.org>
    Acked-by: Andrew Vagin <avagin at odin.com>
    Reported-by: Oleksiy Shchukin <oshchukin at cloudlinux.com>
---
 fs/ext4/pfcache.c | 2 +-
 mm/memory.c       | 7 +------
 2 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/fs/ext4/pfcache.c b/fs/ext4/pfcache.c
index 2789508..b75c26d 100644
--- a/fs/ext4/pfcache.c
+++ b/fs/ext4/pfcache.c
@@ -77,6 +77,7 @@ int ext4_open_pfcache(struct inode *inode)
 	ret = open_mapping_peer(inode->i_mapping, &path, &init_cred);
 	if (!ret)
 		percpu_counter_inc(&EXT4_SB(inode->i_sb)->s_pfcache_peers);
+	path_put(&path);
 	return ret;
 }
 
@@ -193,7 +194,6 @@ int ext4_relink_pfcache(struct super_block *sb, char *new_root, bool new_sb)
 		}
 
 		if (path.mnt) {
-			path_get(&path);
 			if (!open_mapping_peer(inode->i_mapping,
 						&path, &init_cred))
 				nr_opened++;
diff --git a/mm/memory.c b/mm/memory.c
index 2f09839..618c36c 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4317,7 +4317,6 @@ restart:
 	if (!peer->i_peer_file) {
 		file = dentry_open(path, O_RDONLY | O_LARGEFILE, cred);
 		if (IS_ERR(file)) {
-			path_put(path);
 			return PTR_ERR(file);
 		}
 
@@ -4334,8 +4333,6 @@ restart:
 		}
 		if (peer->i_peer_file) {
 			spin_unlock(&inode->i_lock);
-			*path = file->f_path;
-			path_get(path);
 			fput(file);
 			file = NULL;
 			goto restart;
@@ -4361,9 +4358,7 @@ restart:
 	if (file) {
 		file_accessed(file);
 		fput(file);
-	} else
-		path_put(path);
-
+	}
 	return 0;
 }
 EXPORT_SYMBOL(open_mapping_peer);