Merge tag 'ceph-for-5.5-rc8' of https://github.com/ceph/ceph-client
Pull ceph fix from Ilya Dryomov: "A fix for a potential use-after-free from Jeff, marked for stable" * tag 'ceph-for-5.5-rc8' of https://github.com/ceph/ceph-client: ceph: hold extra reference to r_parent over life of request
This commit is contained in:
@ -708,8 +708,10 @@ void ceph_mdsc_release_request(struct kref *kref)
|
|||||||
/* avoid calling iput_final() in mds dispatch threads */
|
/* avoid calling iput_final() in mds dispatch threads */
|
||||||
ceph_async_iput(req->r_inode);
|
ceph_async_iput(req->r_inode);
|
||||||
}
|
}
|
||||||
if (req->r_parent)
|
if (req->r_parent) {
|
||||||
ceph_put_cap_refs(ceph_inode(req->r_parent), CEPH_CAP_PIN);
|
ceph_put_cap_refs(ceph_inode(req->r_parent), CEPH_CAP_PIN);
|
||||||
|
ceph_async_iput(req->r_parent);
|
||||||
|
}
|
||||||
ceph_async_iput(req->r_target_inode);
|
ceph_async_iput(req->r_target_inode);
|
||||||
if (req->r_dentry)
|
if (req->r_dentry)
|
||||||
dput(req->r_dentry);
|
dput(req->r_dentry);
|
||||||
@ -2676,8 +2678,10 @@ int ceph_mdsc_submit_request(struct ceph_mds_client *mdsc, struct inode *dir,
|
|||||||
/* take CAP_PIN refs for r_inode, r_parent, r_old_dentry */
|
/* take CAP_PIN refs for r_inode, r_parent, r_old_dentry */
|
||||||
if (req->r_inode)
|
if (req->r_inode)
|
||||||
ceph_get_cap_refs(ceph_inode(req->r_inode), CEPH_CAP_PIN);
|
ceph_get_cap_refs(ceph_inode(req->r_inode), CEPH_CAP_PIN);
|
||||||
if (req->r_parent)
|
if (req->r_parent) {
|
||||||
ceph_get_cap_refs(ceph_inode(req->r_parent), CEPH_CAP_PIN);
|
ceph_get_cap_refs(ceph_inode(req->r_parent), CEPH_CAP_PIN);
|
||||||
|
ihold(req->r_parent);
|
||||||
|
}
|
||||||
if (req->r_old_dentry_dir)
|
if (req->r_old_dentry_dir)
|
||||||
ceph_get_cap_refs(ceph_inode(req->r_old_dentry_dir),
|
ceph_get_cap_refs(ceph_inode(req->r_old_dentry_dir),
|
||||||
CEPH_CAP_PIN);
|
CEPH_CAP_PIN);
|
||||||
|
Reference in New Issue
Block a user