Re: [PATCH] NFS: Fix directory delegation verifier checks

Al Viro
2026-04-04T18:29:10Z

[cc to fsdevel added]

On Wed, Dec 31, 2025 at 09:52:35PM +0000, Trond Myklebust wrote:

> +static void nfs_clear_verifier_directory(struct inode *dir)
> +{
> + struct dentry *this_parent;
> + struct dentry *dentry;
> + struct inode *inode;
> +
> + if (hlist_empty(&dir->i_dentry))
> + return;
> + this_parent =
> + hlist_entry(dir->i_dentry.first, struct dentry, d_u.d_alias);
> +
> + spin_lock(&this_parent->d_lock);
> + nfs_unset_verifier_delegated(&this_parent->d_time);
> + dentry = d_first_child(this_parent);
> + hlist_for_each_entry_from(dentry, d_sib) {
> + if (unlikely(dentry->d_flags & DCACHE_DENTRY_CURSOR))
> + continue;
> + inode = d_inode_rcu(dentry);
> + if (inode &&
> + NFS_PROTO(inode)->have_delegation(inode, FMODE_READ, 0))
> + continue;

What's to stop the inode from being freed right under you? You are *not*
guaranteed to be holding rcu_read_lock(), unless I'm missing something
in the call chain, so... what's going on here?