• Yan, Zheng's avatar
    ceph: avoid dereferencing invalid pointer during cached readdir · 5495c2d0
    Yan, Zheng authored
    Readdir cache keeps array of dentry pointers in page cache. If any
    dentry in readdir cache gets pruned, ceph_d_prune() disables readdir
    cache for later readdir syscall. The problem is that ceph_d_prune()
    ignores unhashed dentry. Ideally MDS should have already revoked
    CEPH_CAP_FILE_SHARED (which also disables readdir cache) when dentry
    gets unhashed. But if it is somehow MDS does not properly revoke
    CEPH_CAP_FILE_SHARED and the unhashed dentry gets pruned later,
    ceph_d_prune() will not disable readdir cache, later readdir may
    reference invalid dentry pointer.
    
    The fix is make ceph_d_prune() do extra check for unhashed dentry.
    Disable readdir cache if the unhashed dentry is still referenced
    by readdir cache.
    
    Another fix in this patch is handle d_splice_alias(). If a dentry
    gets spliced into new parent dentry, treat it as if it was pruned
    (call ceph_d_prune() for it).
    Signed-off-by: default avatar"Yan, Zheng" <zyan@redhat.com>
    Acked-by: default avatarJeff Layton <jlayton@redhat.com>
    Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
    5495c2d0
inode.c 61.3 KB