Commit 43137370 authored by Jeff Layton's avatar Jeff Layton Committed by Greg Kroah-Hartman

ceph: fix potential race in ceph_check_caps

[ Upstream commit dc3da046 ]

Nothing ensures that session will still be valid by the time we
dereference the pointer. Take and put a reference.

In principle, we should always be able to get a reference here, but
throw a warning if that's ever not the case.
Signed-off-by: default avatarJeff Layton <jlayton@kernel.org>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 5a30a810
......@@ -1807,12 +1807,24 @@ void ceph_check_caps(struct ceph_inode_info *ci, int flags,
if (mutex_trylock(&session->s_mutex) == 0) {
dout("inverting session/ino locks on %p\n",
session);
session = ceph_get_mds_session(session);
spin_unlock(&ci->i_ceph_lock);
if (took_snap_rwsem) {
up_read(&mdsc->snap_rwsem);
took_snap_rwsem = 0;
}
mutex_lock(&session->s_mutex);
if (session) {
mutex_lock(&session->s_mutex);
ceph_put_mds_session(session);
} else {
/*
* Because we take the reference while
* holding the i_ceph_lock, it should
* never be NULL. Throw a warning if it
* ever is.
*/
WARN_ON_ONCE(true);
}
goto retry;
}
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment