iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ceph: fix null pointer deref on anon root dentry release

Browse Source 
When we release a root dentry, particularly after a splice, the parent
(actually our) inode was evaluating to NULL and was getting dereferenced
by ceph_snap().  This is reproduced by something as simple as

 mount -t ceph monhost:/a/b mnt
 mount -t ceph monhost:/a mnt2
 ls mnt2

A splice_dentry() would kill the old 'b' inode's root dentry, and we'd
crash while releasing it.

Fix by checking for both the ROOT and NULL cases explicitly.  We only need
to invalidate the parent dir when we have a correct parent to invalidate.

Signed-off-by: Sage Weil <sage@newdream.net>
This commit is contained in:
Sage Weil 2010-08-26 16:12:01 -07:00
parent 2bfc96a127
commit ca04d9c3ec
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fs/ceph/dir.c
View File

@ -1021,11 +1021,15 @@ out_touch:
static void ceph_dentry_release(struct dentry *dentry) static void ceph_dentry_release(struct dentry *dentry)
{ {
struct ceph_dentry_info *di = ceph_dentry(dentry); struct ceph_dentry_info *di = ceph_dentry(dentry);
struct inode *parent_inode = dentry->d_parent->d_inode; struct inode *parent_inode = NULL;
u64 snapid = ceph_snap(parent_inode); u64 snapid = CEPH_NOSNAP;
if (!IS_ROOT(dentry)) {
parent_inode = dentry->d_parent->d_inode;
if (parent_inode)
snapid = ceph_snap(parent_inode);
}
dout("dentry_release %p parent %p\n", dentry, parent_inode); dout("dentry_release %p parent %p\n", dentry, parent_inode);
if (parent_inode && snapid != CEPH_SNAPDIR) { if (parent_inode && snapid != CEPH_SNAPDIR) {
struct ceph_inode_info *ci = ceph_inode(parent_inode); struct ceph_inode_info *ci = ceph_inode(parent_inode);