Blame SOURCES/autofs-5.1.7-fix-inconsistent-locking-in-umount_subtree_mounts.patch

beb904
autofs-5.1.7 - fix inconsistent locking in umount_subtree_mounts()
beb904
beb904
From: Ian Kent <raven@themaw.net>
beb904
beb904
Some map entry cache locking inconsistencies have crept in.
beb904
beb904
In umount_subtree_mounts() the cache write lock should be held when
beb904
deleting multi-mount cache entries.
beb904
beb904
Signed-off-by: Ian Kent <raven@themaw.net>
beb904
---
beb904
 CHANGELOG          |    1 +
beb904
 daemon/automount.c |   42 ++++++++++++++++++++++++++++++------------
beb904
 lib/mounts.c       |    8 --------
beb904
 3 files changed, 31 insertions(+), 20 deletions(-)
beb904
beb904
--- autofs-5.1.4.orig/CHANGELOG
beb904
+++ autofs-5.1.4/CHANGELOG
beb904
@@ -14,6 +14,7 @@
beb904
 - eliminate clean_stale_multi_triggers().
beb904
 - simplify mount_subtree() mount check.
beb904
 - fix mnts_get_expire_list() expire list construction.
beb904
+- fix inconsistent locking in umount_subtree_mounts().
beb904
 
beb904
 xx/xx/2018 autofs-5.1.5
beb904
 - fix flag file permission.
beb904
--- autofs-5.1.4.orig/daemon/automount.c
beb904
+++ autofs-5.1.4/daemon/automount.c
beb904
@@ -527,8 +527,11 @@ static int umount_subtree_mounts(struct
beb904
 	struct mapent_cache *mc;
beb904
 	struct mapent *me;
beb904
 	unsigned int is_mm_root = 0;
beb904
+	int cur_state;
beb904
 	int left;
beb904
 
beb904
+	pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cur_state);
beb904
+
beb904
 	me = lookup_source_mapent(ap, path, LKP_DISTINCT);
beb904
 	if (!me) {
beb904
 		char *ind_key;
beb904
@@ -548,11 +551,11 @@ static int umount_subtree_mounts(struct
beb904
 	left = 0;
beb904
 
beb904
 	if (me && me->multi) {
beb904
-		char root[PATH_MAX];
beb904
+		char root[PATH_MAX + 1];
beb904
+		char key[PATH_MAX + 1];
beb904
+		struct mapent *tmp;
beb904
+		int status;
beb904
 		char *base;
beb904
-		int cur_state;
beb904
-
beb904
-		pthread_cleanup_push(cache_lock_cleanup, mc);
beb904
 
beb904
 		if (!strchr(me->multi->key, '/'))
beb904
 			/* Indirect multi-mount root */
beb904
@@ -567,25 +570,40 @@ static int umount_subtree_mounts(struct
beb904
 		else
beb904
 			base = me->key + strlen(root);
beb904
 
beb904
-		pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cur_state);
beb904
-		/* Lock the closest parent nesting point for umount */
beb904
-		cache_multi_writelock(me->parent);
beb904
-		if (umount_multi_triggers(ap, me, root, base)) {
beb904
+		left = umount_multi_triggers(ap, me, root, base);
beb904
+		if (left) {
beb904
 			warn(ap->logopt,
beb904
 			     "some offset mounts still present under %s", path);
beb904
+		}
beb904
+
beb904
+		strcpy(key, me->key);
beb904
+
beb904
+		cache_unlock(mc);
beb904
+		cache_writelock(mc);
beb904
+		tmp = cache_lookup_distinct(mc, key);
beb904
+		/* mapent went away while we waited? */
beb904
+		if (tmp != me) {
beb904
+			cache_unlock(mc);
beb904
+			pthread_setcancelstate(cur_state, NULL);
beb904
+			return 0;
beb904
+		}
beb904
+
beb904
+		if (!left && is_mm_root) {
beb904
+			status = cache_delete_offset_list(mc, me->key);
beb904
+			if (status != CHE_OK)
beb904
+				warn(ap->logopt, "couldn't delete offset list");
beb904
 			left++;
beb904
 		}
beb904
-		cache_multi_unlock(me->parent);
beb904
+
beb904
 		if (ap->entry->maps &&
beb904
 		    (ap->entry->maps->flags & MAP_FLAG_FORMAT_AMD))
beb904
 			cache_pop_mapent(me);
beb904
-		pthread_setcancelstate(cur_state, NULL);
beb904
-		pthread_cleanup_pop(0);
beb904
 	}
beb904
-
beb904
 	if (me)
beb904
 		cache_unlock(mc);
beb904
 
beb904
+	pthread_setcancelstate(cur_state, NULL);
beb904
+
beb904
 	if (left || is_autofs_fs)
beb904
 		return left;
beb904
 
beb904
--- autofs-5.1.4.orig/lib/mounts.c
beb904
+++ autofs-5.1.4/lib/mounts.c
beb904
@@ -2730,9 +2730,6 @@ int umount_multi_triggers(struct autofs_
beb904
 	left = do_umount_multi_triggers(ap, me, root, base);
beb904
 
beb904
 	if (!left && me->multi == me) {
beb904
-		struct mapent_cache *mc = me->mc;
beb904
-		int status;
beb904
-
beb904
 		/*
beb904
 		 * Special case.
beb904
 		 * If we can't umount the root container then we can't
beb904
@@ -2750,11 +2747,6 @@ int umount_multi_triggers(struct autofs_
beb904
 			}
beb904
 		}
beb904
 
beb904
-		/* We're done - clean out the offsets */
beb904
-		status = cache_delete_offset_list(mc, me->key);
beb904
-		if (status != CHE_OK)
beb904
-			warn(ap->logopt, "couldn't delete offset list");
beb904
-
beb904
 	       /* check for mounted mount entry and remove it if found */
beb904
                mnts_remove_mount(root, MNTS_MOUNTED);
beb904
 	}