[Linux-cachefs] evict_inode() vs iget5_locked() race [was Re: Blast from the past, CacheFiles: Error: Unexpected object collision]

[Al Viro]

On Thu, Sep 19, 2013 at 09:26:49AM +0100, David Howells wrote:

> There's a potential race between evict_inode() and iget5_locked() in which the
> former can be tearing down an inode corresponding to a file whilst the latter
> is trying to set up a new inode corresponding to that same file - but it's
> possible that the cleanups for the former may adversely affect the setups for
> the latter.

evict() calls ->evict_inode() before removing it from hash.  It's called
only with I_FREEING already set.  If find_inode() runs across that
sucker, it will wait for evict() to do
	wake_up_bit(&inode->i_state, __I_NEW);
(after return from ->evict_inode() and after removal from hash chain)
and repeat the search.

Details, please...