]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
authorRoberto Bergantinos Corpas <rbergant@redhat.com>
Thu, 19 Feb 2026 12:04:40 +0000 (13:04 +0100)
committerAnna Schumaker <anna.schumaker@oracle.com>
Mon, 23 Feb 2026 16:41:38 +0000 (11:41 -0500)
commit410666a298c34ebd57256fde6b24c96bd23059a2
tree09a8f134956bf99547e43a9acc2b43f59744f51a
parent6de23f81a5e08be8fbf5e8d7e9febc72a5b5f27f
nfs: return EISDIR on nfs3_proc_create if d_alias is a dir

If we found an alias through nfs3_do_create/nfs_add_or_obtain
/d_splice_alias which happens to be a dir dentry, we don't return
any error, and simply forget about this alias, but the original
dentry we were adding and passed as parameter remains negative.

This later causes an oops on nfs_atomic_open_v23/finish_open since we
supply a negative dentry to do_dentry_open.

This has been observed running lustre-racer, where dirs and files are
created/removed concurrently with the same name and O_EXCL is not
used to open files (frequent file redirection).

While d_splice_alias typically returns a directory alias or NULL, we
explicitly check d_is_dir() to ensure that we don't attempt to perform
file operations (like finish_open) on a directory inode, which triggers
the observed oops.

Fixes: 7c6c5249f061 ("NFS: add atomic_open for NFSv3 to handle O_TRUNC correctly.")
Reviewed-by: Olga Kornievskaia <okorniev@redhat.com>
Reviewed-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Roberto Bergantinos Corpas <rbergant@redhat.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
fs/nfs/nfs3proc.c