trans: fix reference counting and destruction of fake nodes

Previously, fakeroot tried to do too much in netfs_node_norefs.  This
function is meant to deallocate nodes.  Fakeroot however also tries to
remove the node from the hash table and to prolong the lifetime of the
node object by re-referencing it.

Removing the object from the hash table is highly problematic, because
at this point we already have the node locked.  With proper locking in
netfs_S_dir_lookup, acquiring the hash table lock while we hold the
node locked results in dead-locks, releasing the node lock before
acquiring the hash table lock results in a race condition.

Prolonging the lifetime of the node by re-acquiring a reference is
clearly a hack that surprisingly works to some degree.  The nodes
transbox, however, is already gone at this point.

This code was never actually run because of a reference-counting bug
in fakeroot.

Fix this by installing our own clean routine in the
netfs_protid_class.  This function is called without the associated
node being locked, allowing us to acquire the locks in the proper
order and to keep the hash table locked while the node is being
destroyed.

* trans/fakeroot.c (netfs_node_norefs): Just free the associated
resources.
(fakeroot_netfs_release_protid): New function doing cleanly what
netfs_node_norefs did before.
(netfs_S_dir_lookup): Reuse the fake reference.
(main): Install fakeroot_netfs_release_protid as clean routine.

fixup_fix_refc_destruction

0 files changed, 0 insertions, 0 deletions