lkml.org 
[lkml]   [2020]   [Sep]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 190/206] ceph: fix potential race in ceph_check_caps
    Date
    From: Jeff Layton <jlayton@kernel.org>

    [ Upstream commit dc3da0461cc4b76f2d0c5b12247fcb3b520edbbf ]

    Nothing ensures that session will still be valid by the time we
    dereference the pointer. Take and put a reference.

    In principle, we should always be able to get a reference here, but
    throw a warning if that's ever not the case.

    Signed-off-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/ceph/caps.c | 14 +++++++++++++-
    1 file changed, 13 insertions(+), 1 deletion(-)

    diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
    index a2d4eed27f804..c0dbf8b7762b4 100644
    --- a/fs/ceph/caps.c
    +++ b/fs/ceph/caps.c
    @@ -2015,12 +2015,24 @@ ack:
    if (mutex_trylock(&session->s_mutex) == 0) {
    dout("inverting session/ino locks on %p\n",
    session);
    + session = ceph_get_mds_session(session);
    spin_unlock(&ci->i_ceph_lock);
    if (took_snap_rwsem) {
    up_read(&mdsc->snap_rwsem);
    took_snap_rwsem = 0;
    }
    - mutex_lock(&session->s_mutex);
    + if (session) {
    + mutex_lock(&session->s_mutex);
    + ceph_put_mds_session(session);
    + } else {
    + /*
    + * Because we take the reference while
    + * holding the i_ceph_lock, it should
    + * never be NULL. Throw a warning if it
    + * ever is.
    + */
    + WARN_ON_ONCE(true);
    + }
    goto retry;
    }
    }
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-09-18 04:40    [W:4.103 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site