On Thu, 2019-05-23 at 16:13 +0800, Yan, Zheng wrote:
> ceph_d_revalidate(, LOOKUP_RCU) may call __ceph_caps_issued_mask()
> on a freeing inode.
>
> Signed-off-by: "Yan, Zheng" <zyan@xxxxxxxxxx>
> ---
> fs/ceph/caps.c | 10 ++++++----
> fs/ceph/inode.c | 2 +-
> fs/ceph/super.h | 2 +-
> 3 files changed, 8 insertions(+), 6 deletions(-)
>
> diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
> index 0176241eaea7..7754d7679122 100644
> --- a/fs/ceph/caps.c
> +++ b/fs/ceph/caps.c
> @@ -1263,20 +1263,22 @@ static int send_cap_msg(struct cap_msg_args *arg)
> }
>
> /*
> - * Queue cap releases when an inode is dropped from our cache. Since
> - * inode is about to be destroyed, there is no need for i_ceph_lock.
> + * Queue cap releases when an inode is dropped from our cache.
> */
> -void __ceph_remove_caps(struct inode *inode)
> +void __ceph_remove_caps(struct ceph_inode_info *ci)
> {
> - struct ceph_inode_info *ci = ceph_inode(inode);
> struct rb_node *p;
>
> + /* lock i_ceph_lock, because ceph_d_revalidate(..., LOOKUP_RCU)
> + * may call __ceph_caps_issued_mask() on a freeing inode. */
> + spin_lock(&ci->i_ceph_lock);
> p = rb_first(&ci->i_caps);
> while (p) {
> struct ceph_cap *cap = rb_entry(p, struct ceph_cap, ci_node);
> p = rb_next(p);
> __ceph_remove_cap(cap, true);
> }
> + spin_unlock(&ci->i_ceph_lock);
> }
>
> /*
> diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
> index e47a25495be5..30d0cdc21035 100644
> --- a/fs/ceph/inode.c
> +++ b/fs/ceph/inode.c
> @@ -534,7 +534,7 @@ void ceph_destroy_inode(struct inode *inode)
>
> ceph_fscache_unregister_inode_cookie(ci);
>
> - __ceph_remove_caps(inode);
> + __ceph_remove_caps(ci);
>
> if (__ceph_has_any_quota(ci))
> ceph_adjust_quota_realms_count(inode, false);
> diff --git a/fs/ceph/super.h b/fs/ceph/super.h
> index 11aeb540b0cf..e74867743e07 100644
> --- a/fs/ceph/super.h
> +++ b/fs/ceph/super.h
> @@ -1003,7 +1003,7 @@ extern void ceph_add_cap(struct inode *inode,
> unsigned cap, unsigned seq, u64 realmino, int flags,
> struct ceph_cap **new_cap);
> extern void __ceph_remove_cap(struct ceph_cap *cap, bool queue_release);
> -extern void __ceph_remove_caps(struct inode* inode);
> +extern void __ceph_remove_caps(struct ceph_inode_info *ci);
> extern void ceph_put_cap(struct ceph_mds_client *mdsc,
> struct ceph_cap *cap);
> extern int ceph_is_any_caps(struct inode *inode);
Reviewed-by: Jeff Layton <jlayton@xxxxxxxxxx>
