ceph: disable cached readdir after dropping positive dentry

Ideally CEPH_CAP_FILE_SHARED should have been revoked before
postive dentry get dropped. But if something goes wrong, later
cached readdir may dereference the dropped dentry.

Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

1 files changed, 6 insertions, 1 deletions

diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 6301bf299b7c..16d8b9dac649 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -1186,6 +1186,7 @@ retry_lookup:
                                     ceph_snap(d_inode(dn)) != tvino.snap)) {
                                 dout(" dn %p points to wrong inode %p\n",
                                      dn, d_inode(dn));
+                                ceph_dir_clear_ordered(dir);
                                 d_delete(dn);
                                 dput(dn);
                                 goto retry_lookup;
@@ -1323,6 +1324,7 @@ retry_lookup:
                         dout(" %p links to %p %llx.%llx, not %llx.%llx\n",
                              dn, d_inode(dn), ceph_vinop(d_inode(dn)),
                              ceph_vinop(in));
+                        ceph_dir_clear_ordered(dir);
                         d_invalidate(dn);
                         have_lease = false;
                 }
@@ -1574,6 +1576,7 @@ retry_lookup:
                             ceph_snap(d_inode(dn)) != tvino.snap)) {
                         dout(" dn %p points to wrong inode %p\n",
                              dn, d_inode(dn));
+                        __ceph_dir_clear_ordered(ci);
                         d_delete(dn);
                         dput(dn);
                         goto retry_lookup;
@@ -1598,7 +1601,9 @@ retry_lookup:
                                  &req->r_caps_reservation);
                 if (ret < 0) {
                         pr_err("fill_inode badness on %p\n", in);
-                        if (d_really_is_negative(dn))
+                        if (d_really_is_positive(dn))
+                                __ceph_dir_clear_ordered(ci);
+                        else
                                 iput(in);
                         d_drop(dn);
                         err = ret;