diff options
| author | Jeff Layton <jlayton@kernel.org> | 2020-03-20 16:45:45 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-10-01 11:11:56 +0200 |
| commit | da1935ae27d6af755d561204cf4b2ba2cf39fbd0 (patch) | |
| tree | 071aebba91c8b55c3dc73f6e03337367e41a81f5 | |
| parent | bc5d9f7ad8d8efd5d7f0f8d2e818b0d8f9764526 (diff) | |
ceph: fix potential race in ceph_check_caps
[ Upstream commit dc3da0461cc4b76f2d0c5b12247fcb3b520edbbf ]
Nothing ensures that session will still be valid by the time we
dereference the pointer. Take and put a reference.
In principle, we should always be able to get a reference here, but
throw a warning if that's ever not the case.
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | fs/ceph/caps.c | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 3d0497421e62..49e693232916 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -1777,12 +1777,24 @@ ack: if (mutex_trylock(&session->s_mutex) == 0) { dout("inverting session/ino locks on %p\n", session); + session = ceph_get_mds_session(session); spin_unlock(&ci->i_ceph_lock); if (took_snap_rwsem) { up_read(&mdsc->snap_rwsem); took_snap_rwsem = 0; } - mutex_lock(&session->s_mutex); + if (session) { + mutex_lock(&session->s_mutex); + ceph_put_mds_session(session); + } else { + /* + * Because we take the reference while + * holding the i_ceph_lock, it should + * never be NULL. Throw a warning if it + * ever is. + */ + WARN_ON_ONCE(true); + } goto retry; } } |