exportfs_decode_fh(): negative pinned may become positive without the parent locked
[ Upstream commit a2ece088882666e1dc7113744ac912eb161e3f87 ] Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
dadd71d18a
commit
af17e1fc7c
1 changed files with 19 additions and 12 deletions
|
@ -517,26 +517,33 @@ struct dentry *exportfs_decode_fh(struct vfsmount *mnt, struct fid *fid,
|
|||
* inode is actually connected to the parent.
|
||||
*/
|
||||
err = exportfs_get_name(mnt, target_dir, nbuf, result);
|
||||
if (!err) {
|
||||
inode_lock(target_dir->d_inode);
|
||||
nresult = lookup_one_len(nbuf, target_dir,
|
||||
strlen(nbuf));
|
||||
inode_unlock(target_dir->d_inode);
|
||||
if (!IS_ERR(nresult)) {
|
||||
if (nresult->d_inode) {
|
||||
dput(result);
|
||||
result = nresult;
|
||||
} else
|
||||
dput(nresult);
|
||||
}
|
||||
if (err) {
|
||||
dput(target_dir);
|
||||
goto err_result;
|
||||
}
|
||||
|
||||
inode_lock(target_dir->d_inode);
|
||||
nresult = lookup_one_len(nbuf, target_dir, strlen(nbuf));
|
||||
if (!IS_ERR(nresult)) {
|
||||
if (unlikely(nresult->d_inode != result->d_inode)) {
|
||||
dput(nresult);
|
||||
nresult = ERR_PTR(-ESTALE);
|
||||
}
|
||||
}
|
||||
inode_unlock(target_dir->d_inode);
|
||||
/*
|
||||
* At this point we are done with the parent, but it's pinned
|
||||
* by the child dentry anyway.
|
||||
*/
|
||||
dput(target_dir);
|
||||
|
||||
if (IS_ERR(nresult)) {
|
||||
err = PTR_ERR(nresult);
|
||||
goto err_result;
|
||||
}
|
||||
dput(result);
|
||||
result = nresult;
|
||||
|
||||
/*
|
||||
* And finally make sure the dentry is actually acceptable
|
||||
* to NFSD.
|
||||
|
|
Loading…
Reference in a new issue