4 files changed, 17 insertions, 11 deletions

diff --git a/fs/ceph/debugfs.c b/fs/ceph/debugfs.c
index 0dba6915712b..fb962efdacee 100644
--- a/fs/ceph/debugfs.c
+++ b/fs/ceph/debugfs.c
@@ -102,7 +102,7 @@ static int mdsc_show(struct seq_file *s, void *p)
                                 path = NULL;
                         spin_lock(&req->r_old_dentry->d_lock);
                         seq_printf(s, " #%llx/%.*s (%s)",
-                           ceph_ino(req->r_old_dentry->d_parent->d_inode),
+                           ceph_ino(req->r_old_dentry_dir),
                                    req->r_old_dentry->d_name.len,
                                    req->r_old_dentry->d_name.name,
                                    path ? path : "");
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 33a19df72288..7263f825d426 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -811,6 +811,7 @@ static int ceph_link(struct dentry *old_dentry, struct inode *dir,
         req->r_dentry = dget(dentry);
         req->r_num_caps = 2;
         req->r_old_dentry = dget(old_dentry); /* or inode? hrm. */
+        req->r_old_dentry_dir = ceph_get_dentry_parent_inode(old_dentry);
         req->r_locked_dir = dir;
         req->r_dentry_drop = CEPH_CAP_FILE_SHARED;
         req->r_dentry_unless = CEPH_CAP_FILE_EXCL;
@@ -909,6 +910,7 @@ static int ceph_rename(struct inode *old_dir, struct dentry *old_dentry,
         req->r_dentry = dget(new_dentry);
         req->r_num_caps = 2;
         req->r_old_dentry = dget(old_dentry);
+        req->r_old_dentry_dir = ceph_get_dentry_parent_inode(old_dentry);
         req->r_locked_dir = new_dir;
         req->r_old_dentry_drop = CEPH_CAP_FILE_SHARED;
         req->r_old_dentry_unless = CEPH_CAP_FILE_EXCL;
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 8a09cd5a659e..66a8939cc518 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -483,22 +483,26 @@ void ceph_mdsc_release_request(struct kref *kref)
                 destroy_reply_info(&req->r_reply_info);
         }
         if (req->r_inode) {
-                ceph_put_cap_refs(ceph_inode(req->r_inode),
-                                  CEPH_CAP_PIN);
+                ceph_put_cap_refs(ceph_inode(req->r_inode), CEPH_CAP_PIN);
                 iput(req->r_inode);
         }
         if (req->r_locked_dir)
-                ceph_put_cap_refs(ceph_inode(req->r_locked_dir),
-                                  CEPH_CAP_PIN);
+                ceph_put_cap_refs(ceph_inode(req->r_locked_dir), CEPH_CAP_PIN);
         if (req->r_target_inode)
                 iput(req->r_target_inode);
         if (req->r_dentry)
                 dput(req->r_dentry);
         if (req->r_old_dentry) {
-                ceph_put_cap_refs(
-                        ceph_inode(req->r_old_dentry->d_parent->d_inode),
-                        CEPH_CAP_PIN);
+                /*
+                 * track (and drop pins for) r_old_dentry_dir
+                 * separately, since r_old_dentry's d_parent may have
+                 * changed between the dir mutex being dropped and
+                 * this request being freed.
+                 */
+                ceph_put_cap_refs(ceph_inode(req->r_old_dentry_dir),
+                                  CEPH_CAP_PIN);
                 dput(req->r_old_dentry);
+                iput(req->r_old_dentry_dir);
         }
         kfree(req->r_path1);
         kfree(req->r_path2);
@@ -1931,9 +1935,8 @@ int ceph_mdsc_do_request(struct ceph_mds_client *mdsc,
         if (req->r_locked_dir)
                 ceph_get_cap_refs(ceph_inode(req->r_locked_dir), CEPH_CAP_PIN);
         if (req->r_old_dentry)
-                ceph_get_cap_refs(
-                        ceph_inode(req->r_old_dentry->d_parent->d_inode),
-                        CEPH_CAP_PIN);
+                ceph_get_cap_refs(ceph_inode(req->r_old_dentry_dir),
+                                  CEPH_CAP_PIN);
 
         /* issue */
         mutex_lock(&mdsc->mutex);
diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h
index 8a40f0636ba9..4bb239921dbd 100644
--- a/fs/ceph/mds_client.h
+++ b/fs/ceph/mds_client.h
@@ -171,6 +171,7 @@ struct ceph_mds_request {
         struct inode *r_inode;              /* arg1 */
         struct dentry *r_dentry;            /* arg1 */
         struct dentry *r_old_dentry;        /* arg2: rename from or link from */
+        struct inode *r_old_dentry_dir;     /* arg2: old dentry's parent dir */
         char *r_path1, *r_path2;
         struct ceph_vino r_ino1, r_ino2;