diff options
| author | Sage Weil <sage@newdream.net> | 2011-07-26 20:30:29 +0200 |
|---|---|---|
| committer | Sage Weil <sage@newdream.net> | 2011-07-26 20:30:29 +0200 |
| commit | 5f21c96dd5c615341963036ae8f5e4f5227a818d (patch) | |
| tree | 898c5781623b68527427d201e3f975827d08935c /fs/ceph/ioctl.c | |
| parent | ceph: handle racing calls to ceph_init_dentry (diff) | |
| download | linux-5f21c96dd5c615341963036ae8f5e4f5227a818d.tar.xz linux-5f21c96dd5c615341963036ae8f5e4f5227a818d.zip | |
ceph: protect access to d_parent
d_parent is protected by d_lock: use it when looking up a dentry's parent
directory inode. Also take a reference and drop it in the caller to avoid
a use-after-free.
Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Reviewed-by: Yehuda Sadeh <yehuda@hq.newdream.net>
Signed-off-by: Sage Weil <sage@newdream.net>
Diffstat (limited to 'fs/ceph/ioctl.c')
| -rw-r--r-- | fs/ceph/ioctl.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c index a757a5680578..3b256b50f7d8 100644 --- a/fs/ceph/ioctl.c +++ b/fs/ceph/ioctl.c @@ -38,7 +38,7 @@ static long ceph_ioctl_get_layout(struct file *file, void __user *arg) static long ceph_ioctl_set_layout(struct file *file, void __user *arg) { struct inode *inode = file->f_dentry->d_inode; - struct inode *parent_inode = file->f_dentry->d_parent->d_inode; + struct inode *parent_inode; struct ceph_mds_client *mdsc = ceph_sb_to_client(inode->i_sb)->mdsc; struct ceph_mds_request *req; struct ceph_ioctl_layout l; @@ -87,7 +87,9 @@ static long ceph_ioctl_set_layout(struct file *file, void __user *arg) req->r_args.setlayout.layout.fl_pg_preferred = cpu_to_le32(l.preferred_osd); + parent_inode = ceph_get_dentry_parent_inode(file->f_dentry); err = ceph_mdsc_do_request(mdsc, parent_inode, req); + iput(parent_inode); ceph_mdsc_put_request(req); return err; } |