Bug #657: nfs-reexport null deref in ceph_init_dentry - Linux kernel client - Ceph

Actions

Copy link

Bug #657

closed

nfs-reexport null deref in ceph_init_dentry

Added by Sage Weil over 13 years ago. Updated over 13 years ago.

Status:

Resolved

Priority:

Urgent

Assignee:

Sage Weil

Category:

Target version:

v2.6.37

% Done:

Spent time:

0:30 h

Source:

Tags:

Backport:

Regression:

Severity:

Reviewed:

Affected Versions:

ceph-qa-suite:

Crash signature (v1):

Crash signature (v2):

Description

Al Viro observes:

        * ceph: nfs export code is fucked and AFAICT untested - the first
call of ceph_init_dentry() from ceph_fh_to_parent() that actually tries to
do anything (i.e. gets called on fh of directory outside of current dentry
tree) will blow up on attempt to dereference ->d_parent->d_inode.

Probably the d_op initialization should be moved to a different helper. We can do the d_op initialization in NFS reexport explicitly since it's always the live namespace (no snapshot reexport). And test!