Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 933ad2c9 authored by Yan, Zheng's avatar Yan, Zheng Committed by Ilya Dryomov
Browse files

ceph: disable cached readdir after dropping positive dentry 



Ideally CEPH_CAP_FILE_SHARED should have been revoked before
postive dentry get dropped. But if something goes wrong, later
cached readdir may dereference the dropped dentry.

Signed-off-by: default avatar"Yan, Zheng" <zyan@redhat.com>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
parent 7271efa7

fs/ceph/inode.c

+6 −1
Original line number Original line Diff line number Diff line
@@ -1186,6 +1186,7 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req) 
				    ceph_snap(d_inode(dn)) != tvino.snap)) {

				    ceph_snap(d_inode(dn)) != tvino.snap)) {

				dout(" dn %p points to wrong inode %p\n",

				dout(" dn %p points to wrong inode %p\n",

				     dn, d_inode(dn));

				     dn, d_inode(dn));

				ceph_dir_clear_ordered(dir);

				d_delete(dn);

				d_delete(dn);

				dput(dn);

				dput(dn);

				goto retry_lookup;

				goto retry_lookup;
@@ -1323,6 +1324,7 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req) 
			dout(" %p links to %p %llx.%llx, not %llx.%llx\n",

			dout(" %p links to %p %llx.%llx, not %llx.%llx\n",

			     dn, d_inode(dn), ceph_vinop(d_inode(dn)),

			     dn, d_inode(dn), ceph_vinop(d_inode(dn)),

			     ceph_vinop(in));

			     ceph_vinop(in));

			ceph_dir_clear_ordered(dir);

			d_invalidate(dn);

			d_invalidate(dn);

			have_lease = false;

			have_lease = false;

		}

		}
@@ -1574,6 +1576,7 @@ int ceph_readdir_prepopulate(struct ceph_mds_request *req, 
			    ceph_snap(d_inode(dn)) != tvino.snap)) {

			    ceph_snap(d_inode(dn)) != tvino.snap)) {

			dout(" dn %p points to wrong inode %p\n",

			dout(" dn %p points to wrong inode %p\n",

			     dn, d_inode(dn));

			     dn, d_inode(dn));

			__ceph_dir_clear_ordered(ci);

			d_delete(dn);

			d_delete(dn);

			dput(dn);

			dput(dn);

			goto retry_lookup;

			goto retry_lookup;
@@ -1598,7 +1601,9 @@ int ceph_readdir_prepopulate(struct ceph_mds_request *req, 
				 &req->r_caps_reservation);

				 &req->r_caps_reservation);

		if (ret < 0) {

		if (ret < 0) {

			pr_err("fill_inode badness on %p\n", in);

			pr_err("fill_inode badness on %p\n", in);

			if (d_really_is_negative(dn))

			if (d_really_is_positive(dn))

				__ceph_dir_clear_ordered(ci);

			else

				iput(in);

				iput(in);

			d_drop(dn);

			d_drop(dn);

			err = ret;

			err = ret;