)]}'
{
  "commit": "033790449ba9c4dcf8478a87693d33df625c23b5",
  "tree": "41cae3efc255949643166e9dad79bc8fc00893b8",
  "parents": [
    "cab0936aac8aa907c6bb814c2cf26385478f254b"
  ],
  "author": {
    "name": "Jeff Moyer",
    "email": "jmoyer@redhat.com",
    "time": "Thu May 01 04:35:08 2008 -0700"
  },
  "committer": {
    "name": "Linus Torvalds",
    "email": "torvalds@linux-foundation.org",
    "time": "Thu May 01 08:04:01 2008 -0700"
  },
  "message": "autofs4: fix execution order race in mount request code\n\nJeff Moyer has identified a race in due to an execution order dependency\nin the autofs4 function root.c:try_to_fill_dentry().\n\nJeff\u0027s description of this race is:\n\n\"P1 does a lookup of /mount/submount/foo.  Since the VFS can\u0027t find an entry\nfor \"foo\" under /mount/submount, it calls into the autofs4 kernel module to\nallocate a new dentry, D1.  The kernel creates a new waitq for this lookup and\ncalls the daemon to perform the mount.\n\nThe daemon performs a mkdir of the \"foo\" directory under /mount/submount,\nwhich ends up creating a *new* dentry, D2.\n\nThen, P2 does a lookup of /mount/submount/foo.  The VFS path walking logic\nfinds a dentry in the dcache, D2, and calls the revalidate function with this.\n In the autofs4 revalidate code, we then trigger a mount, since the dentry is\nan empty directory that isn\u0027t a mountpoint, and so set DCACHE_AUTOFS_PENDING\nand call into the wait code to trigger the mount.\n\nThe wait code finds our existing waitq entry (since it is keyed off of the\ndirectory name) and adds itself to the list of waiters.\n\nAfter the daemon finishes the mount, it calls back into the kernel to release\nthe waiters.  When this happens, P1 is woken up and goes about clearing the\nDCACHE_AUTOFS_PENDING flag, but it does this in D1!  So, given that P1 in our\ncase is a program that will immediately try to access a file under\n/mount/submount/foo, we end up finding the dentry D2 which still has the\npending flag set, and we set out to wait for a mount *again*!\n\nSo, one way to address this is to re-do the lookup at the end of\ntry_to_fill_dentry, and to clear the pending flag on the hashed dentry.  This\nseems a sane approach to me.\"\n\nAnd Jeff\u0027s patch does this.\n\nSigned-off-by: Jeff Moyer \u003cjmoyer@redhat.com\u003e\nSigned-off-by-by: Ian Kent \u003craven@themaw.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "aa4c5ff8a40dfcf65babdd56c9e6fac056b4423f",
      "old_mode": 33188,
      "old_path": "fs/autofs4/root.c",
      "new_id": "0533d37c73ae852c19b1302ea481889a5861bc0a",
      "new_mode": 33188,
      "new_path": "fs/autofs4/root.c"
    }
  ]
}