[PATCH 6.12 1087/1102] rpc_pipe: dont overdo directory locking
flat view
COLD25d
REVIEWED: 4 (4M)
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: 2026-09-17 19:03:52
Also in:
linux-patches
1 review trailer.
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit 41a6b9e52b21544c334830bfe68fb78d6677caa0 ]
Don't try to hold directories locked more than VFS requires;
lock just before getting a child to be made positive (using
simple_start_creating()) and unlock as soon as the child is
created. There's no benefit in keeping the parent locked
while populating the child - it won't stop dcache lookups anyway.
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Stable-dep-of: 932a8cf6abb2 ("sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/rpc_pipe.c | 25 ++++++++++++-------------
1 file changed, 12 insertions(+), 13 deletions(-)
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c@@ -698,12 +698,14 @@ static int rpc_populate(struct dentry *p struct dentry *dentry; int i, err; - inode_lock(dir); for (i = start; i < eof; i++) { + inode_lock(dir); dentry = __rpc_lookup_create_exclusive(parent, files[i].name); err = PTR_ERR(dentry); - if (IS_ERR(dentry)) + if (IS_ERR(dentry)) { + inode_unlock(dir); goto out_bad; + } switch (files[i].mode & S_IFMT) { default: BUG();
@@ -712,20 +714,20 @@ static int rpc_populate(struct dentry *p files[i].mode, files[i].i_fop, private); + inode_unlock(dir); break; case S_IFDIR: err = __rpc_mkdir(dir, dentry, files[i].mode, NULL, private); + inode_unlock(dir); } if (err != 0) goto out_bad; } - inode_unlock(dir); return 0; out_bad: - inode_unlock(dir); printk(KERN_WARNING "%s: %s failed to populate directory %pd\n", __FILE__, __func__, parent); return err;
@@ -741,25 +743,22 @@ static struct dentry *rpc_mkdir_populate inode_lock_nested(dir, I_MUTEX_PARENT); dentry = __rpc_lookup_create_exclusive(parent, name); - if (IS_ERR(dentry)) - goto out; + if (IS_ERR(dentry)) { + inode_unlock(dir); + return dentry; + } error = __rpc_mkdir(dir, dentry, mode, NULL, private); + inode_unlock(dir); if (error != 0) - goto out_err; + return ERR_PTR(error); if (populate != NULL) { error = populate(dentry, args_populate); if (error) { - inode_unlock(dir); simple_recursive_removal(dentry, NULL); return ERR_PTR(error); } } -out: - inode_unlock(dir); return dentry; -out_err: - dentry = ERR_PTR(error); - goto out; } static int rpc_rmdir_depopulate(struct dentry *dentry,