summaryrefslogtreecommitdiff
path: root/fs/ceph
diff options
context:
space:
mode:
authorYan, Zheng <zyan@redhat.com>2019-01-10 10:41:09 +0300
committerIlya Dryomov <idryomov@gmail.com>2019-01-21 16:52:41 +0300
commitd95e674c01cfb5461e8b9fdeebf6d878c9b80b2f (patch)
tree32bb67b2dd4df148f628eb4af8bcdf612622e66b /fs/ceph
parent49a57857aeea06ca831043acbb0fa5e0f50602fd (diff)
downloadlinux-d95e674c01cfb5461e8b9fdeebf6d878c9b80b2f.tar.xz
ceph: clear inode pointer when snap realm gets dropped by its inode
snap realm and corresponding inode have pointers to each other. The two pointer should get clear at the same time. Otherwise, snap realm's pointer may reference freed inode. Cc: stable@vger.kernel.org # 4.17+ Signed-off-by: "Yan, Zheng" <zyan@redhat.com> Reviewed-by: Luis Henriques <lhenriques@suse.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'fs/ceph')
-rw-r--r--fs/ceph/caps.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 94c026bba2c2..bba28a5034ba 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1035,6 +1035,8 @@ static void drop_inode_snap_realm(struct ceph_inode_info *ci)
list_del_init(&ci->i_snap_realm_item);
ci->i_snap_realm_counter++;
ci->i_snap_realm = NULL;
+ if (realm->ino == ci->i_vino.ino)
+ realm->inode = NULL;
spin_unlock(&realm->inodes_with_caps_lock);
ceph_put_snap_realm(ceph_sb_to_client(ci->vfs_inode.i_sb)->mdsc,
realm);