diff options
| author | Jeff Layton <jlayton@redhat.com> | 2016-12-15 08:37:57 -0500 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2017-02-20 12:16:05 +0100 |
| commit | c6b0b656ca24ede6657abb4a2cd910fa9c1879ba (patch) | |
| tree | 1ea5dce4a9aa8a92587524a12d9a72f7f2e9a33a /fs/ceph/mds_client.c | |
| parent | 30c71233a1d4b5c23ad6652847285bf6b57086e2 (diff) | |
| download | linux-c6b0b656ca24ede6657abb4a2cd910fa9c1879ba.tar.gz linux-c6b0b656ca24ede6657abb4a2cd910fa9c1879ba.tar.bz2 linux-c6b0b656ca24ede6657abb4a2cd910fa9c1879ba.zip | |
ceph: clean up unsafe d_parent accesses in build_dentry_path
While we hold a reference to the dentry when build_dentry_path is
called, we could end up racing with a rename that changes d_parent.
Handle that situation correctly, by using the rcu_read_lock to
ensure that the parent dentry and inode stick around long enough
to safely check ceph_snap and ceph_ino.
Link: http://tracker.ceph.com/issues/18148
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Reviewed-by: Yan, Zheng <zyan@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'fs/ceph/mds_client.c')
| -rw-r--r-- | fs/ceph/mds_client.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index 377ac34ddbb3..7c2eb28c24f6 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -1800,13 +1800,18 @@ static int build_dentry_path(struct dentry *dentry, int *pfreepath) { char *path; + struct inode *dir; - if (ceph_snap(d_inode(dentry->d_parent)) == CEPH_NOSNAP) { - *pino = ceph_ino(d_inode(dentry->d_parent)); + rcu_read_lock(); + dir = d_inode_rcu(dentry->d_parent); + if (dir && ceph_snap(dir) == CEPH_NOSNAP) { + *pino = ceph_ino(dir); + rcu_read_unlock(); *ppath = dentry->d_name.name; *ppathlen = dentry->d_name.len; return 0; } + rcu_read_unlock(); path = ceph_mdsc_build_path(dentry, ppathlen, pino, 1); if (IS_ERR(path)) return PTR_ERR(path); |