LU-13617 llite: don't hold inode_lock for security notify

[fs/lustre-release.git] / lustre / llite / namei.c

diff --git a/lustre/llite/namei.c b/lustre/llite/namei.c
index e358e7a..f569da1 100644 (file)
--- a/lustre/llite/namei.c
+++ b/lustre/llite/namei.c
@@ -664,10 +664,12 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
                }
 
                if (secctx != NULL && secctxlen != 0) {
-                       inode_lock(inode);
+                       /* no need to protect selinux_inode_setsecurity() by
+                        * inode_lock. Taking it would lead to a client deadlock
+                        * LU-13617
+                        */
                        rc = security_inode_notifysecctx(inode, secctx,
                                                         secctxlen);
-                       inode_unlock(inode);
                        if (rc)
                                CWARN("cannot set security context for "
                                      DFID": rc = %d\n",
@@ -1205,12 +1207,14 @@ static int ll_create_it(struct inode *dir, struct dentry *dentry,
 
        if ((ll_i2sbi(inode)->ll_flags & LL_SBI_FILE_SECCTX) &&
            secctx != NULL) {
-               inode_lock(inode);
                /* must be done before d_instantiate, because it calls
                 * security_d_instantiate, which means a getxattr if security
                 * context is not set yet */
+               /* no need to protect selinux_inode_setsecurity() by
+                * inode_lock. Taking it would lead to a client deadlock
+                * LU-13617
+                */
                rc = security_inode_notifysecctx(inode, secctx, secctxlen);
-               inode_unlock(inode);
                if (rc)
                        RETURN(rc);
        }
@@ -1376,14 +1380,16 @@ again:
                GOTO(err_exit, err);
 
        if (sbi->ll_flags & LL_SBI_FILE_SECCTX) {
-               inode_lock(inode);
                /* must be done before d_instantiate, because it calls
                 * security_d_instantiate, which means a getxattr if security
                 * context is not set yet */
+               /* no need to protect selinux_inode_setsecurity() by
+                * inode_lock. Taking it would lead to a client deadlock
+                * LU-13617
+                */
                err = security_inode_notifysecctx(inode,
                                                  op_data->op_file_secctx,
                                                  op_data->op_file_secctx_size);
-               inode_unlock(inode);
                if (err)
                        GOTO(err_exit, err);
        }