shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-07 11:26:02 +09:00
Code Issues Packages Projects Releases Wiki Activity

pNFS: Fix use after free issues in pnfs_do_read()

Browse Source 
[ Upstream commit 6aeafd05ec ]

The assumption should be that if the caller returns PNFS_ATTEMPTED, then hdr
has been consumed, and so we should not be testing hdr->task.tk_status.
If the caller returns PNFS_TRY_AGAIN, then we need to recoalesce and
free hdr.

Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Trond Myklebust
2017-04-25 11:26:53 -04:00
committed by Greg Kroah-Hartman
parent 81fa323990
commit b5e7b5ce7f
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
fs/nfs/pnfs.c
View File

@@ -2308,10 +2308,20 @@ pnfs_do_read(struct nfs_pageio_descriptor *desc, struct nfs_pgio_header *hdr)
enum pnfs_try_status trypnfs;
trypnfs = pnfs_try_to_read_data(hdr, call_ops, lseg);
if (trypnfs == PNFS_TRY_AGAIN)
pnfs_read_resend_pnfs(hdr);
if (trypnfs == PNFS_NOT_ATTEMPTED || hdr->task.tk_status)
switch (trypnfs) {
case PNFS_NOT_ATTEMPTED:
pnfs_read_through_mds(desc, hdr);
case PNFS_ATTEMPTED:
break;
case PNFS_TRY_AGAIN:
/* cleanup hdr and prepare to redo pnfs */
if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags)) {
struct nfs_pgio_mirror *mirror = nfs_pgio_current_mirror(desc);
list_splice_init(&hdr->pages, &mirror->pg_list);
mirror->pg_recoalesce = 1;
}
hdr->mds_ops->rpc_release(hdr);
}
}
static void pnfs_readhdr_free(struct nfs_pgio_header *hdr)