nfsd: racy access to ->d_name in nsfd4_encode_path()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index c2a4701d7286478cca66cda986565a7b3105504c..d9454fe5653f70af2175432d22e36cebcbaef5be 100644 (file)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1816,10 +1816,7 @@ static __be32 nfsd4_encode_fs_location4(struct nfsd4_fs_location *location,
 static __be32 nfsd4_encode_path(const struct path *root,
                const struct path *path, __be32 **pp, int *buflen)
 {
-       struct path cur = {
-               .mnt = path->mnt,
-               .dentry = path->dentry,
-       };
+       struct path cur = *path;
        __be32 *p = *pp;
        struct dentry **components = NULL;
        unsigned int ncomponents = 0;
@@ -1859,14 +1856,19 @@ static __be32 nfsd4_encode_path(const struct path *root,
 
        while (ncomponents) {
                struct dentry *dentry = components[ncomponents - 1];
-               unsigned int len = dentry->d_name.len;
+               unsigned int len;
 
+               spin_lock(&dentry->d_lock);
+               len = dentry->d_name.len;
                *buflen -= 4 + (XDR_QUADLEN(len) << 2);
-               if (*buflen < 0)
+               if (*buflen < 0) {
+                       spin_unlock(&dentry->d_lock);
                        goto out_free;
+               }
                WRITE32(len);
                WRITEMEM(dentry->d_name.name, len);
                dprintk("/%s", dentry->d_name.name);
+               spin_unlock(&dentry->d_lock);
                dput(dentry);
                ncomponents--;
        }