[PATCH] fuse: hold inode reference across d_splice_alias()

[Jun Yao]

When fuse_direntplus_link() calls d_splice_alias() with an inode
returned by fuse_iget(), d_splice_alias() can drop that reference
before returning an error. In particular, __d_unalias() can return
-ESTALE when it cannot move the old directory alias. The caller then
decrements nlookup through the inode pointer. A concurrent
FUSE_NOTIFY_INVAL_ENTRY can drop the last alias and let RCU free the
fuse_inode before that access.

Take an extra inode reference before d_splice_alias() and release it after
the nlookup rollback or after a successful splice.

Fixes: b8bd342d50cb ("fuse: nlookup missing decrement in fuse_direntplus_link")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jun Yao <yaojun8558363@xxxxxxxxx>

---
 fs/fuse/readdir.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/fuse/readdir.c b/fs/fuse/readdir.c
index 1f6cf5654..aca25e5db 100644
--- a/fs/fuse/readdir.c
+++ b/fs/fuse/readdir.c
@@ -238,8 +238,11 @@ static int fuse_direntplus_link(struct file *file,
 		inode = fuse_iget(dir->i_sb, o->nodeid, o->generation,
 				  &o->attr, ATTR_TIMEOUT(o),
 				  attr_version, evict_ctr);
+		/* Keep inode alive if d_splice_alias() drops its reference. */
 		if (!inode)
 			inode = ERR_PTR(-ENOMEM);
+		else
+			ihold(inode);
 
 		alias = d_splice_alias(inode, dentry);
 		d_lookup_done(dentry);
@@ -254,9 +257,12 @@ static int fuse_direntplus_link(struct file *file,
 				spin_lock(&fi->lock);
 				fi->nlookup--;
 				spin_unlock(&fi->lock);
+				iput(inode);
 			}
 			return PTR_ERR(dentry);
 		}
+		if (!IS_ERR(inode))
+			iput(inode);
 	}
 	if (fc->readdirplus_auto)
 		set_bit(FUSE_I_INIT_RDPLUS, &get_fuse_inode(inode)->state);