Commit fa0a4e3b authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'ceph-for-5.5-rc8' of https://github.com/ceph/ceph-client 

Pull ceph fix from Ilya Dryomov:
 "A fix for a potential use-after-free from Jeff, marked for stable"

* tag 'ceph-for-5.5-rc8' of https://github.com/ceph/ceph-client:
  ceph: hold extra reference to r_parent over life of request
parents 3a83c8c8 9c1c2b35

fs/ceph/mds_client.c

+6 −2
Original line number Diff line number Diff line
@@ -708,8 +708,10 @@ void ceph_mdsc_release_request(struct kref *kref) 
		/* avoid calling iput_final() in mds dispatch threads */

		ceph_async_iput(req->r_inode);

	}

	if (req->r_parent)

	if (req->r_parent) {

		ceph_put_cap_refs(ceph_inode(req->r_parent), CEPH_CAP_PIN);

		ceph_async_iput(req->r_parent);

	}

	ceph_async_iput(req->r_target_inode);

	if (req->r_dentry)

		dput(req->r_dentry);
@@ -2676,8 +2678,10 @@ int ceph_mdsc_submit_request(struct ceph_mds_client *mdsc, struct inode *dir, 
	/* take CAP_PIN refs for r_inode, r_parent, r_old_dentry */

	if (req->r_inode)

		ceph_get_cap_refs(ceph_inode(req->r_inode), CEPH_CAP_PIN);

	if (req->r_parent)

	if (req->r_parent) {

		ceph_get_cap_refs(ceph_inode(req->r_parent), CEPH_CAP_PIN);

		ihold(req->r_parent);

	}

	if (req->r_old_dentry_dir)

		ceph_get_cap_refs(ceph_inode(req->r_old_dentry_dir),

				  CEPH_CAP_PIN);