diff options
| author | Jeff Layton <jlayton@kernel.org> | 2020-03-20 21:45:45 +0100 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2020-06-01 13:22:52 +0200 |
| commit | dc3da0461cc4b76f2d0c5b12247fcb3b520edbbf (patch) | |
| tree | a4f408a4f23b07ff2aab8a9875cdc84257a39f8a | |
| parent | ceph: document what protects i_dirty_item and i_flushing_item (diff) | |
| download | linux-dc3da0461cc4b76f2d0c5b12247fcb3b520edbbf.tar.xz linux-dc3da0461cc4b76f2d0c5b12247fcb3b520edbbf.zip | |
ceph: fix potential race in ceph_check_caps
Nothing ensures that session will still be valid by the time we
dereference the pointer. Take and put a reference.
In principle, we should always be able to get a reference here, but
throw a warning if that's ever not the case.
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
| -rw-r--r-- | fs/ceph/caps.c | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index f135660a2479..d555d2790619 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -2044,12 +2044,24 @@ ack: if (mutex_trylock(&session->s_mutex) == 0) { dout("inverting session/ino locks on %p\n", session); + session = ceph_get_mds_session(session); spin_unlock(&ci->i_ceph_lock); if (took_snap_rwsem) { up_read(&mdsc->snap_rwsem); took_snap_rwsem = 0; } - mutex_lock(&session->s_mutex); + if (session) { + mutex_lock(&session->s_mutex); + ceph_put_mds_session(session); + } else { + /* + * Because we take the reference while + * holding the i_ceph_lock, it should + * never be NULL. Throw a warning if it + * ever is. + */ + WARN_ON_ONCE(true); + } goto retry; } } |