From: Al Viro <viro@zeniv.linux.org.uk>
Date: Fri, 15 Sep 2023 01:55:29 +0000 (-0400)
Subject: ceph_wait_on_conflict_unlink(): grab reference before dropping ->d_lock
X-Git-Tag: v6.5.11~30
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4ec5def876948e199efb370d394646d2f49d3a9d;p=thirdparty%2Fkernel%2Fstable.git

ceph_wait_on_conflict_unlink(): grab reference before dropping ->d_lock

[ Upstream commit dc32464a5fe4946fe1a4d8f8e29961dc411933c5 ]

Use of dget() after we'd dropped ->d_lock is too late - dentry might
be gone by that point.

Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 4b0ba067e9c93..e40aafbfa7b9f 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -709,8 +709,8 @@ int ceph_wait_on_conflict_unlink(struct dentry *dentry)
 		if (!d_same_name(udentry, pdentry, &dname))
 			goto next;
 
+		found = dget_dlock(udentry);
 		spin_unlock(&udentry->d_lock);
-		found = dget(udentry);
 		break;
 next:
 		spin_unlock(&udentry->d_lock);