From: Jeff Layton Date: Thu, 15 Dec 2016 13:37:57 +0000 (-0500) Subject: ceph: clean up unsafe d_parent accesses in build_dentry_path X-Git-Tag: v4.11-rc1~47^2~50 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c6b0b656ca24ede6657abb4a2cd910fa9c1879ba;p=thirdparty%2Fkernel%2Flinux.git ceph: clean up unsafe d_parent accesses in build_dentry_path While we hold a reference to the dentry when build_dentry_path is called, we could end up racing with a rename that changes d_parent. Handle that situation correctly, by using the rcu_read_lock to ensure that the parent dentry and inode stick around long enough to safely check ceph_snap and ceph_ino. Link: http://tracker.ceph.com/issues/18148 Signed-off-by: Jeff Layton Reviewed-by: Yan, Zheng Signed-off-by: Ilya Dryomov --- diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index 377ac34ddbb3a..7c2eb28c24f64 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -1800,13 +1800,18 @@ static int build_dentry_path(struct dentry *dentry, int *pfreepath) { char *path; + struct inode *dir; - if (ceph_snap(d_inode(dentry->d_parent)) == CEPH_NOSNAP) { - *pino = ceph_ino(d_inode(dentry->d_parent)); + rcu_read_lock(); + dir = d_inode_rcu(dentry->d_parent); + if (dir && ceph_snap(dir) == CEPH_NOSNAP) { + *pino = ceph_ino(dir); + rcu_read_unlock(); *ppath = dentry->d_name.name; *ppathlen = dentry->d_name.len; return 0; } + rcu_read_unlock(); path = ceph_mdsc_build_path(dentry, ppathlen, pino, 1); if (IS_ERR(path)) return PTR_ERR(path);