From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757086AbdJKAvK (ORCPT ); Tue, 10 Oct 2017 20:51:10 -0400 Received: from omzsmtpe01.verizonbusiness.com ([199.249.25.210]:29357 "EHLO omzsmtpe01.verizonbusiness.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756858AbdJKArs (ORCPT ); Tue, 10 Oct 2017 20:47:48 -0400 From: "Levin, Alexander (Sasha Levin)" X-Host: endeavour.tdc.vzwcorp.com To: "gregkh@linuxfoundation.org" CC: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" Subject: [GIT PULL for-4.4 20/25] ceph: clean up unsafe d_parent accesses in build_dentry_path Thread-Topic: [GIT PULL for-4.4 20/25] ceph: clean up unsafe d_parent accesses in build_dentry_path Thread-Index: AQHTQipEICjCxaHbRUCB0AC6D6DZXQ== Date: Wed, 11 Oct 2017 00:45:43 +0000 Message-ID: <20171011004533.8044-21-alexander.levin@verizon.com> References: <20171011004533.8044-1-alexander.levin@verizon.com> In-Reply-To: <20171011004533.8044-1-alexander.levin@verizon.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.144.60.250] Content-Type: text/plain; charset="iso-8859-1" MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id v9B0pdRv030065 From: Jeff Layton [ Upstream commit c6b0b656ca24ede6657abb4a2cd910fa9c1879ba ] While we hold a reference to the dentry when build_dentry_path is called, we could end up racing with a rename that changes d_parent. Handle that situation correctly, by using the rcu_read_lock to ensure that the parent dentry and inode stick around long enough to safely check ceph_snap and ceph_ino. Link: http://tracker.ceph.com/issues/18148 Signed-off-by: Jeff Layton Reviewed-by: Yan, Zheng Signed-off-by: Ilya Dryomov Signed-off-by: Sasha Levin --- fs/ceph/mds_client.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index f54f77037d22..ead89489ae71 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -1845,13 +1845,18 @@ static int build_dentry_path(struct dentry *dentry, int *pfreepath) { char *path; + struct inode *dir; - if (ceph_snap(d_inode(dentry->d_parent)) == CEPH_NOSNAP) { - *pino = ceph_ino(d_inode(dentry->d_parent)); + rcu_read_lock(); + dir = d_inode_rcu(dentry->d_parent); + if (dir && ceph_snap(dir) == CEPH_NOSNAP) { + *pino = ceph_ino(dir); + rcu_read_unlock(); *ppath = dentry->d_name.name; *ppathlen = dentry->d_name.len; return 0; } + rcu_read_unlock(); path = ceph_mdsc_build_path(dentry, ppathlen, pino, 1); if (IS_ERR(path)) return PTR_ERR(path); -- 2.11.0