vfs: don't evict uninitialized inode

commit e950564b97fd0f541b02eb207685d0746f5ecf29 upstream.

iput() ends up calling ->evict() on new inode, which is not yet initialized
by owning fs.  So use destroy_inode() instead.

Add to sb->s_inodes list only if inode is not in I_CREATING state (meaning
that it wasn't allocated with new_inode(), which already does the
insertion).

Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes: 80ea09a002bf ("vfs: factor out inode_insert5()")
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/inode.c b/fs/inode.c
index 56501fa..a06de44 100644 (file)
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1050,6 +1050,7 @@ struct inode *inode_insert5(struct inode *inode, unsigned long hashval,
 {
        struct hlist_head *head = inode_hashtable + hash(inode->i_sb, hashval);
        struct inode *old;
+       bool creating = inode->i_state & I_CREATING;
 
 again:
        spin_lock(&inode_hash_lock);
@@ -1083,6 +1084,8 @@ again:
        inode->i_state |= I_NEW;
        hlist_add_head(&inode->i_hash, head);
        spin_unlock(&inode->i_lock);
+       if (!creating)
+               inode_sb_list_add(inode);
 unlock:
        spin_unlock(&inode_hash_lock);
 
@@ -1117,12 +1120,13 @@ struct inode *iget5_locked(struct super_block *sb, unsigned long hashval,
        struct inode *inode = ilookup5(sb, hashval, test, data);
 
        if (!inode) {
-               struct inode *new = new_inode(sb);
+               struct inode *new = alloc_inode(sb);
 
                if (new) {
+                       new->i_state = 0;
                        inode = inode_insert5(new, hashval, test, set, data);
                        if (unlikely(inode != new))
-                               iput(new);
+                               destroy_inode(new);
                }
        }
        return inode;