SUNRPC: Ensure that rpc_mkpipe returns a refcounted dentry

If not, we cannot guarantee that idmap->idmap_dentry, gss_auth->dentry and
clnt->cl_dentry are valid dentries.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

4 files changed, 9 insertions, 2 deletions

diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c
index 821edd30333b..32c95a0d93f3 100644
--- a/fs/nfs/idmap.c
+++ b/fs/nfs/idmap.c
@@ -132,6 +132,8 @@ nfs_idmap_delete(struct nfs4_client *clp)
 
         if (!idmap)
                 return;
+        dput(idmap->idmap_dentry);
+        idmap->idmap_dentry = NULL;
         rpc_unlink(idmap->idmap_path);
         clp->cl_idmap = NULL;
         kfree(idmap);
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index bb46efd92e57..900ef31f5a0e 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -721,6 +721,8 @@ gss_destroy(struct rpc_auth *auth)
 
         gss_auth = container_of(auth, struct gss_auth, rpc_auth);
         rpc_unlink(gss_auth->path);
+        dput(gss_auth->dentry);
+        gss_auth->dentry = NULL;
         gss_mech_put(gss_auth->mech);
 
         rpcauth_free_credcache(auth);
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index d78479782045..a6d7c332dd49 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -240,6 +240,7 @@ rpc_clone_client(struct rpc_clnt *clnt)
         new->cl_autobind = 0;
         new->cl_oneshot = 0;
         new->cl_dead = 0;
+        dget(new->cl_dentry);
         rpc_init_rtt(&new->cl_rtt_default, clnt->cl_xprt->timeout.to_initval);
         if (new->cl_auth)
                 atomic_inc(&new->cl_auth->au_count);
@@ -314,6 +315,8 @@ rpc_destroy_client(struct rpc_clnt *clnt)
         if (clnt->cl_server != clnt->cl_inline_name)
                 kfree(clnt->cl_server);
 out_free:
+        if (clnt->cl_dentry)
+                dput(clnt->cl_dentry);
         kfree(clnt);
         return 0;
 }
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 567abbe25bc8..72b22172f0af 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -669,7 +669,7 @@ rpc_mkdir(char *path, struct rpc_clnt *rpc_client)
 out:
         mutex_unlock(&dir->i_mutex);
         rpc_release_path(&nd);
-        return dentry;
+        return dget(dentry);
 err_depopulate:
         rpc_depopulate(dentry);
         __rpc_rmdir(dir, dentry);
@@ -733,7 +733,7 @@ rpc_mkpipe(char *path, void *private, struct rpc_pipe_ops *ops, int flags)
 out:
         mutex_unlock(&dir->i_mutex);
         rpc_release_path(&nd);
-        return dentry;
+        return dget(dentry);
 err_dput:
         dput(dentry);
         dentry = ERR_PTR(-ENOMEM);