[Devel] [PATCH RH7] nfs: remove excess dput in nfs_prime_dcache
    Pavel Tikhomirov 
    ptikhomirov at virtuozzo.com
       
    Thu Aug 11 16:54:55 MSK 2022
    
    
  
Imagine code path:
static
void nfs_prime_dcache(struct dentry *parent, struct nfs_entry *entry)
{
...
        dentry = d_lookup(parent, &filename); // get non-null dentry
        if (dentry != NULL) { // true
                /* Is there a mountpoint here? If so, just exit */
                if (!nfs_fsid_equal(&NFS_SB(dentry->d_sb)->fsid,
                                        &entry->fattr->fsid)) // false
                        goto out;
                if (nfs_same_file(dentry, entry)) { // false
                        if (!entry->fh->size)
                                goto out;
                        nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
                        status = nfs_refresh_inode(dentry->d_inode, entry->fattr);
                        if (!status)
                                nfs_setsecurity(dentry->d_inode, entry->fattr, entry->label);
                        goto out;
                } else {
                        if (d_invalidate(dentry) != 0) // false
                                goto out;
                        dput(dentry); // put dentry first time
                }
        }
        if (!entry->fh->size) // true
		goto out;
...
out:
        dput(dentry); // put dentry second time
}
Because of this excess dput we get a crash in __put_nfs_open_context
as ctx->dentry->inode becomes zero.
Problem appeared due to bad port of [1] in RHEL.
7dc72d5f7a0e ("NFS: Fix inode corruption in nfs_prime_dcache()") [1]
https://jira.sw.ru/browse/PSBM-141526
Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
---
 fs/nfs/dir.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index bd1a419d34c7..033e65319327 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -527,7 +527,7 @@ void nfs_prime_dcache(struct dentry *parent, struct nfs_entry *entry)
 		}
 	}
 	if (!entry->fh->size)
-		goto out;
+		return;
 
 	dentry = d_alloc(parent, &filename);
 	if (dentry == NULL)
-- 
2.37.1
    
    
More information about the Devel
mailing list