ceph-fuse: ::rmdir() uses a deleted memory structure of dentry leads a core

we should add the dentry ref immediately after "get_or_create" in
case of the ref be put to zero.

Fixes: http://tracker.ceph.com/issues/22536
Signed-off-by: YunfeiGuan <yunfeiguan@xtaotech.com>
(cherry picked from commit 65fcccc04a6239a9c7cbf0192de14f963ebf1079)

diff --git a/src/client/Client.cc b/src/client/Client.cc
index 1d9277a61b6ecfb1d5c01f83d2aedc4418600e3f..a8f801b1dfaa2612629993536a6e92dd2296f998 100644 (file)
--- a/src/client/Client.cc
+++ b/src/client/Client.cc
@@ -11969,8 +11969,9 @@ int Client::_rmdir(Inode *dir, const char *name, const UserPerm& perms)
   if (dir->snapid != CEPH_NOSNAP && dir->snapid != CEPH_SNAPDIR) {
     return -EROFS;
   }
-
-  MetaRequest *req = new MetaRequest(dir->snapid == CEPH_SNAPDIR ? CEPH_MDS_OP_RMSNAP:CEPH_MDS_OP_RMDIR);
+  
+  int op = dir->snapid == CEPH_SNAPDIR ? CEPH_MDS_OP_RMSNAP : CEPH_MDS_OP_RMDIR;
+  MetaRequest *req = new MetaRequest(op);
   filepath path;
   dir->make_nosnap_relative_path(path);
   path.push_dentry(name);
@@ -11986,15 +11987,20 @@ int Client::_rmdir(Inode *dir, const char *name, const UserPerm& perms)
   int res = get_or_create(dir, name, &de);
   if (res < 0)
     goto fail;
+  if (op == CEPH_MDS_OP_RMDIR) 
+    req->set_dentry(de);
+  else
+    de->get();
+
   res = _lookup(dir, name, 0, &in, perms);
   if (res < 0)
     goto fail;
-  if (req->get_op() == CEPH_MDS_OP_RMDIR) {
+  if (op == CEPH_MDS_OP_RMDIR) {
     req->set_inode(dir);
-    req->set_dentry(de);
     req->set_other_inode(in.get());
   } else {
     unlink(de, true, true);
+    de->put();
     req->set_other_inode(in.get());
   }