diff options
| author | Jeff Layton <jlayton@kernel.org> | 2020-03-20 16:45:45 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-10-01 13:14:47 +0200 |
| commit | c42c61e98251d5de390434181092ce9e7a9c5719 (patch) | |
| tree | 137ede52e07be45d970740d15ddf6cecaa9fedba | |
| parent | 23c233c606c33251afcafc56ca35b307ed4f2e59 (diff) | |
| download | linux-stable-c42c61e98251d5de390434181092ce9e7a9c5719.tar.gz linux-stable-c42c61e98251d5de390434181092ce9e7a9c5719.tar.bz2 linux-stable-c42c61e98251d5de390434181092ce9e7a9c5719.zip | |
ceph: fix potential race in ceph_check_caps
[ Upstream commit dc3da0461cc4b76f2d0c5b12247fcb3b520edbbf ]
Nothing ensures that session will still be valid by the time we
dereference the pointer. Take and put a reference.
In principle, we should always be able to get a reference here, but
throw a warning if that's ever not the case.
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | fs/ceph/caps.c | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index a2d4eed27f80..c0dbf8b7762b 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -2015,12 +2015,24 @@ ack: if (mutex_trylock(&session->s_mutex) == 0) { dout("inverting session/ino locks on %p\n", session); + session = ceph_get_mds_session(session); spin_unlock(&ci->i_ceph_lock); if (took_snap_rwsem) { up_read(&mdsc->snap_rwsem); took_snap_rwsem = 0; } - mutex_lock(&session->s_mutex); + if (session) { + mutex_lock(&session->s_mutex); + ceph_put_mds_session(session); + } else { + /* + * Because we take the reference while + * holding the i_ceph_lock, it should + * never be NULL. Throw a warning if it + * ever is. + */ + WARN_ON_ONCE(true); + } goto retry; } } |