ceph-fuse: ::rmdir() uses a deleted memory structure of dentry leads a core

we should add the dentry ref immediately after "get_or_create" in
case of the ref be put to zero.

Fixes: http://tracker.ceph.com/issues/22536
Signed-off-by: YunfeiGuan <yunfeiguan@xtaotech.com>

diff --git a/src/client/Client.cc b/src/client/Client.cc
index 1c2d66002eab9cae54558fdf7aaff549c9239576..79aa9ed3206c7a5b0761721b9f87065e7ddf76e0 100644 (file)
--- a/src/client/Client.cc
+++ b/src/client/Client.cc
@@ -12053,8 +12053,9 @@ int Client::_rmdir(Inode *dir, const char *name, const UserPerm& perms)
   if (dir->snapid != CEPH_NOSNAP && dir->snapid != CEPH_SNAPDIR) {
     return -EROFS;
   }
-
-  MetaRequest *req = new MetaRequest(dir->snapid == CEPH_SNAPDIR ? CEPH_MDS_OP_RMSNAP:CEPH_MDS_OP_RMDIR);
+  
+  int op = dir->snapid == CEPH_SNAPDIR ? CEPH_MDS_OP_RMSNAP : CEPH_MDS_OP_RMDIR;
+  MetaRequest *req = new MetaRequest(op);
   filepath path;
   dir->make_nosnap_relative_path(path);
   path.push_dentry(name);
@@ -12070,15 +12071,20 @@ int Client::_rmdir(Inode *dir, const char *name, const UserPerm& perms)
   int res = get_or_create(dir, name, &de);
   if (res < 0)
     goto fail;
+  if (op == CEPH_MDS_OP_RMDIR) 
+    req->set_dentry(de);
+  else
+    de->get();
+
   res = _lookup(dir, name, 0, &in, perms);
   if (res < 0)
     goto fail;
-  if (req->get_op() == CEPH_MDS_OP_RMDIR) {
+  if (op == CEPH_MDS_OP_RMDIR) {
     req->set_inode(dir);
-    req->set_dentry(de);
     req->set_other_inode(in.get());
   } else {
     unlink(de, true, true);
+    de->put();
     req->set_other_inode(in.get());
   }