summaryrefslogtreecommitdiffstats
path: root/fs/ceph
diff options
context:
space:
mode:
authorJeff Layton <jlayton@redhat.com>2016-12-15 14:37:58 +0100
committerIlya Dryomov <idryomov@gmail.com>2017-02-20 12:16:05 +0100
commitadf0d68701c7f3e50f21308c76f41e60956a6832 (patch)
tree82927817ebd1d9d064a2278d42f8b999b2ac7fe4 /fs/ceph
parentceph: pass parent dir ino info to build_dentry_path (diff)
downloadlinux-adf0d68701c7f3e50f21308c76f41e60956a6832.tar.xz
linux-adf0d68701c7f3e50f21308c76f41e60956a6832.zip
ceph: fix unsafe dcache access in ceph_encode_dentry_release
Accessing d_parent requires some sort of locking or it could vanish out from under us. Since we take the d_lock anyway, use that to fetch d_parent and take a reference to it, and then use that reference to call ceph_encode_inode_release. Link: http://tracker.ceph.com/issues/18148 Signed-off-by: Jeff Layton <jlayton@redhat.com> Reviewed-by: Yan, Zheng <zyan@redhat.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'fs/ceph')
-rw-r--r--fs/ceph/caps.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 94fd76d04683..d1b4c543cab1 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -3926,7 +3926,7 @@ int ceph_encode_inode_release(void **p, struct inode *inode,
int ceph_encode_dentry_release(void **p, struct dentry *dentry,
int mds, int drop, int unless)
{
- struct inode *dir = d_inode(dentry->d_parent);
+ struct dentry *parent;
struct ceph_mds_request_release *rel = *p;
struct ceph_dentry_info *di = ceph_dentry(dentry);
int force = 0;
@@ -3941,9 +3941,12 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry,
spin_lock(&dentry->d_lock);
if (di->lease_session && di->lease_session->s_mds == mds)
force = 1;
+ parent = dget(dentry->d_parent);
spin_unlock(&dentry->d_lock);
- ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force);
+ ret = ceph_encode_inode_release(p, d_inode(parent), mds, drop,
+ unless, force);
+ dput(parent);
spin_lock(&dentry->d_lock);
if (ret && di->lease_session && di->lease_session->s_mds == mds) {