Commit d95e674c authored Jan 10, 2019 by Yan, Zheng Committed by Ilya Dryomov Jan 21, 2019

ceph: clear inode pointer when snap realm gets dropped by its inode



snap realm and corresponding inode have pointers to each other.
The two pointer should get clear at the same time. Otherwise,
snap realm's pointer may reference freed inode.

Cc: stable@vger.kernel.org # 4.17+
Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
Reviewed-by: Luis Henriques <lhenriques@suse.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

parent 49a57857

fs/ceph/caps.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -1035,6 +1035,8 @@ static void drop_inode_snap_realm(struct ceph_inode_info *ci)
		list_del_init(&ci->i_snap_realm_item);
		ci->i_snap_realm_counter++;
		ci->i_snap_realm = NULL;
		if (realm->ino == ci->i_vino.ino)
		realm->inode = NULL;
		spin_unlock(&realm->inodes_with_caps_lock);
		ceph_put_snap_realm(ceph_sb_to_client(ci->vfs_inode.i_sb)->mdsc,
		realm);