On Thu, Jan 21, 2021 at 06:49:45PM +0530, Gautham Ananthakrishna wrote:
> + spin_lock(&victim->d_lock);
> + parent = lock_parent(victim);
> +
> + rcu_read_unlock();
Similar story. As soon as you hit that rcu_read_unlock(), the memory
pointed to by victim might be reused. If you have hit __lock_parent(),
victim->d_lock had been dropped and regained. Which means that freeing
might've been already scheduled. Unlike #1/6, here you won't get
memory corruption in lock_parent() itself, but...
> +
> + if (d_count(victim) || !d_is_negative(victim) ||
> + (victim->d_flags & DCACHE_REFERENCED)) {
> + if (parent)
> + spin_unlock(&parent->d_lock);
> + spin_unlock(&victim->d_lock);
... starting from here you just might.
