diff options
| author | Luis Henriques <lhenriques@suse.de> | 2020-11-12 10:45:12 +0000 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2020-12-14 23:21:47 +0100 |
| commit | e5cafce3ad0f8652d6849314d951459c2bff7233 (patch) | |
| tree | 1c0471a9dc891b9db9a0171eda41432e66029468 /tools/perf/scripts/python/bin | |
| parent | ceph: pass down the flags to grab_cache_page_write_begin (diff) | |
| download | linux-e5cafce3ad0f8652d6849314d951459c2bff7233.tar.gz linux-e5cafce3ad0f8652d6849314d951459c2bff7233.zip | |
ceph: fix race in concurrent __ceph_remove_cap invocations
A NULL pointer dereference may occur in __ceph_remove_cap with some of the
callbacks used in ceph_iterate_session_caps, namely trim_caps_cb and
remove_session_caps_cb. Those callers hold the session->s_mutex, so they
are prevented from concurrent execution, but ceph_evict_inode does not.
Since the callers of this function hold the i_ceph_lock, the fix is simply
a matter of returning immediately if caps->ci is NULL.
Cc: stable@vger.kernel.org
URL: https://tracker.ceph.com/issues/43272
Suggested-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Luis Henriques <lhenriques@suse.de>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'tools/perf/scripts/python/bin')
0 files changed, 0 insertions, 0 deletions