)]}'
{
  "commit": "75a6f82a0d10ef8f13cd8fe7212911a0252ab99e",
  "tree": "a3f4a216774bcee4ff373a0e58cdafb1d76bf583",
  "parents": [
    "9391dd00d13c853ab4f2a85435288ae2202e0e43"
  ],
  "author": {
    "name": "Al Viro",
    "email": "viro@ZenIV.linux.org.uk",
    "time": "Wed Jul 08 02:42:38 2015 +0100"
  },
  "committer": {
    "name": "Al Viro",
    "email": "viro@zeniv.linux.org.uk",
    "time": "Sun Jul 12 11:27:04 2015 -0400"
  },
  "message": "freeing unlinked file indefinitely delayed\n\n\tNormally opening a file, unlinking it and then closing will have\nthe inode freed upon close() (provided that it\u0027s not otherwise busy and\nhas no remaining links, of course).  However, there\u0027s one case where that\ndoes *not* happen.  Namely, if you open it by fhandle with cold dcache,\nthen unlink() and close().\n\n\tIn normal case you get d_delete() in unlink(2) notice that dentry\nis busy and unhash it; on the final dput() it will be forcibly evicted from\ndcache, triggering iput() and inode removal.  In this case, though, we end\nup with *two* dentries - disconnected (created by open-by-fhandle) and\nregular one (used by unlink()).  The latter will have its reference to inode\ndropped just fine, but the former will not - it\u0027s considered hashed (it\nis on the -\u003es_anon list), so it will stay around until the memory pressure\nwill finally do it in.  As the result, we have the final iput() delayed\nindefinitely.  It\u0027s trivial to reproduce -\n\nvoid flush_dcache(void)\n{\n        system(\"mount -o remount,rw /\");\n}\n\nstatic char buf[20 * 1024 * 1024];\n\nmain()\n{\n        int fd;\n        union {\n                struct file_handle f;\n                char buf[MAX_HANDLE_SZ];\n        } x;\n        int m;\n\n        x.f.handle_bytes \u003d sizeof(x);\n        chdir(\"/root\");\n        mkdir(\"foo\", 0700);\n        fd \u003d open(\"foo/bar\", O_CREAT | O_RDWR, 0600);\n        close(fd);\n        name_to_handle_at(AT_FDCWD, \"foo/bar\", \u0026x.f, \u0026m, 0);\n        flush_dcache();\n        fd \u003d open_by_handle_at(AT_FDCWD, \u0026x.f, O_RDWR);\n        unlink(\"foo/bar\");\n        write(fd, buf, sizeof(buf));\n        system(\"df .\");\t\t\t/* 20Mb eaten */\n        close(fd);\n        system(\"df .\");\t\t\t/* should\u0027ve freed those 20Mb */\n        flush_dcache();\n        system(\"df .\");\t\t\t/* should be the same as #2 */\n}\n\nwill spit out something like\nFilesystem     1K-blocks   Used Available Use% Mounted on\n/dev/root         322023 303843      1131 100% /\nFilesystem     1K-blocks   Used Available Use% Mounted on\n/dev/root         322023 303843      1131 100% /\nFilesystem     1K-blocks   Used Available Use% Mounted on\n/dev/root         322023 283282     21692  93% /\n- inode gets freed only when dentry is finally evicted (here we trigger\nthan by remount; normally it would\u0027ve happened in response to memory\npressure hell knows when).\n\nCc: stable@vger.kernel.org # v2.6.38+; earlier ones need s/kill_it/unhash_it/\nAcked-by: J. Bruce Fields \u003cbfields@fieldses.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "7a3f3e5f9ceabfc4cad41a5d5478258f7e817dc1",
      "old_mode": 33188,
      "old_path": "fs/dcache.c",
      "new_id": "5c8ea15e73a53b6b6dbe3e9660973d2eda9c7800",
      "new_mode": 33188,
      "new_path": "fs/dcache.c"
    }
  ]
}