Re: [bug report] ceph: fix race condition where r_parent becomes stale before sending message

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Thanks, Dan. I'll send a fix.

On Fri, Aug 15, 2025 at 10:50 AM Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
>
> Hello Alex Markuze,
>
> Commit a69ac54928a4 ("ceph: fix race condition where r_parent becomes
> stale before sending message") from Aug 12, 2025 (linux-next), leads
> to the following Smatch static checker warning:
>
>         fs/ceph/inode.c:1591 ceph_fill_trace()
>         error: 'dir' dereferencing possible ERR_PTR()
>
> fs/ceph/inode.c
>     78  static struct inode *ceph_get_reply_dir(struct super_block *sb,
>     79                                          struct inode *parent,
>     80                                          struct ceph_mds_reply_info_parsed *rinfo)
>     81  {
>     82          struct ceph_vino vino;
>     83
>     84          if (unlikely(!rinfo->diri.in))
>     85                  return parent; /* nothing to compare against */
>     86
>     87          /* If we didn't have a cached parent inode to begin with, just bail out. */
>     88          if (!parent)
>     89                  return NULL;
>                         ^^^^^^^^^^^^
> This returns NULL
>
>     90
>     91          vino.ino  = le64_to_cpu(rinfo->diri.in->ino);
>     92          vino.snap = le64_to_cpu(rinfo->diri.in->snapid);
>     93
>     94          if (likely(ceph_vino_matches_parent(parent, vino)))
>     95                  return parent; /* matches – use the original reference */
>     96
>     97          /* Mismatch – this should be rare.  Emit a WARN and obtain the correct inode. */
>     98          WARN_ONCE(1, "ceph: reply dir mismatch (parent valid %llx.%llx reply %llx.%llx)\n",
>     99                    ceph_ino(parent), ceph_snap(parent), vino.ino, vino.snap);
>    100
>    101          return ceph_get_inode(sb, vino, NULL);
>                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> This returns error pointers, but the caller only checks for NULL.
>
>    102  }
>
> regards,
> dan carpenter
>






[Index of Archives]     [CEPH Users]     [Ceph Large]     [Ceph Dev]     [Information on CEPH]     [Linux BTRFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux