ceph: disable cached readdir after dropping positive dentry

Ideally CEPH_CAP_FILE_SHARED should have been revoked before
postive dentry get dropped. But if something goes wrong, later
cached readdir may dereference the dropped dentry.

Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 6301bf299b7ce8b1a36efbaa076691fddc89cbf2..16d8b9dac64908eb740983f47edcdd828a7b5342 100644 (file)
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -1186,6 +1186,7 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req)
                                    ceph_snap(d_inode(dn)) != tvino.snap)) {
                                dout(" dn %p points to wrong inode %p\n",
                                     dn, d_inode(dn));
+                               ceph_dir_clear_ordered(dir);
                                d_delete(dn);
                                dput(dn);
                                goto retry_lookup;
@@ -1323,6 +1324,7 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req)
                        dout(" %p links to %p %llx.%llx, not %llx.%llx\n",
                             dn, d_inode(dn), ceph_vinop(d_inode(dn)),
                             ceph_vinop(in));
+                       ceph_dir_clear_ordered(dir);
                        d_invalidate(dn);
                        have_lease = false;
                }
@@ -1574,6 +1576,7 @@ int ceph_readdir_prepopulate(struct ceph_mds_request *req,
                            ceph_snap(d_inode(dn)) != tvino.snap)) {
                        dout(" dn %p points to wrong inode %p\n",
                             dn, d_inode(dn));
+                       __ceph_dir_clear_ordered(ci);
                        d_delete(dn);
                        dput(dn);
                        goto retry_lookup;
@@ -1598,7 +1601,9 @@ int ceph_readdir_prepopulate(struct ceph_mds_request *req,
                                 &req->r_caps_reservation);
                if (ret < 0) {
                        pr_err("fill_inode badness on %p\n", in);
-                       if (d_really_is_negative(dn))
+                       if (d_really_is_positive(dn))
+                               __ceph_dir_clear_ordered(ci);
+                       else
                                iput(in);
                        d_drop(dn);
                        err = ret;