summaryrefslogtreecommitdiff
path: root/fs/ceph
diff options
context:
space:
mode:
authorJeff Layton <jlayton@kernel.org>2020-03-20 23:45:45 +0300
committerIlya Dryomov <idryomov@gmail.com>2020-06-01 14:22:52 +0300
commitdc3da0461cc4b76f2d0c5b12247fcb3b520edbbf (patch)
treea4f408a4f23b07ff2aab8a9875cdc84257a39f8a /fs/ceph
parent4fb5dda39c26fa5b64059dac0a2c3340a4f6f11b (diff)
downloadlinux-dc3da0461cc4b76f2d0c5b12247fcb3b520edbbf.tar.xz
ceph: fix potential race in ceph_check_caps
Nothing ensures that session will still be valid by the time we dereference the pointer. Take and put a reference. In principle, we should always be able to get a reference here, but throw a warning if that's ever not the case. Signed-off-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'fs/ceph')
-rw-r--r--fs/ceph/caps.c14
1 files changed, 13 insertions, 1 deletions
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index f135660a2479..d555d2790619 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -2044,12 +2044,24 @@ ack:
if (mutex_trylock(&session->s_mutex) == 0) {
dout("inverting session/ino locks on %p\n",
session);
+ session = ceph_get_mds_session(session);
spin_unlock(&ci->i_ceph_lock);
if (took_snap_rwsem) {
up_read(&mdsc->snap_rwsem);
took_snap_rwsem = 0;
}
- mutex_lock(&session->s_mutex);
+ if (session) {
+ mutex_lock(&session->s_mutex);
+ ceph_put_mds_session(session);
+ } else {
+ /*
+ * Because we take the reference while
+ * holding the i_ceph_lock, it should
+ * never be NULL. Throw a warning if it
+ * ever is.
+ */
+ WARN_ON_ONCE(true);
+ }
goto retry;
}
}