Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'ceph-for-6.2-rc3' of https://github.com/ceph/ceph-client
Pull ceph fixes from Ilya Dryomov:
"Two file locking fixes from Xiubo"
* tag 'ceph-for-6.2-rc3' of https://github.com/ceph/ceph-client:
ceph: avoid use-after-free in ceph_fl_release_lock()
ceph: switch to vfs_inode_has_locks() to fix file lock bug
+22
-8
+1
-1
fs/ceph/caps.c
+1
-1
fs/ceph/caps.c
+18
-6
fs/ceph/locks.c
+18
-6
fs/ceph/locks.c
···
32
32
33
33
static void ceph_fl_copy_lock(struct file_lock *dst, struct file_lock *src)
34
34
{
35
-
struct ceph_file_info *fi = dst->fl_file->private_data;
36
35
struct inode *inode = file_inode(dst->fl_file);
37
36
atomic_inc(&ceph_inode(inode)->i_filelock_ref);
38
-
atomic_inc(&fi->num_locks);
37
+
dst->fl_u.ceph.inode = igrab(inode);
39
38
}
40
39
40
+
/*
41
+
* Do not use the 'fl->fl_file' in release function, which
42
+
* is possibly already released by another thread.
43
+
*/
41
44
static void ceph_fl_release_lock(struct file_lock *fl)
42
45
{
43
-
struct ceph_file_info *fi = fl->fl_file->private_data;
44
-
struct inode *inode = file_inode(fl->fl_file);
45
-
struct ceph_inode_info *ci = ceph_inode(inode);
46
-
atomic_dec(&fi->num_locks);
46
+
struct inode *inode = fl->fl_u.ceph.inode;
47
+
struct ceph_inode_info *ci;
48
+
49
+
/*
50
+
* If inode is NULL it should be a request file_lock,
51
+
* nothing we can do.
52
+
*/
53
+
if (!inode)
54
+
return;
55
+
56
+
ci = ceph_inode(inode);
47
57
if (atomic_dec_and_test(&ci->i_filelock_ref)) {
48
58
/* clear error when all locks are released */
49
59
spin_lock(&ci->i_ceph_lock);
50
60
ci->i_ceph_flags &= ~CEPH_I_ERROR_FILELOCK;
51
61
spin_unlock(&ci->i_ceph_lock);
52
62
}
63
+
fl->fl_u.ceph.inode = NULL;
64
+
iput(inode);
53
65
}
54
66
55
67
static const struct file_lock_operations ceph_fl_lock_ops = {
-1
fs/ceph/super.h
-1
fs/ceph/super.h