Return-Path: Received: from daytona.panasas.com ([67.152.220.89]:36600 "EHLO daytona.panasas.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754666Ab1EYQMc (ORCPT ); Wed, 25 May 2011 12:12:32 -0400 Message-ID: <4DDD2A76.4060005@panasas.com> Date: Wed, 25 May 2011 19:12:38 +0300 From: Boaz Harrosh To: Benny Halevy , Trond Myklebust , linux-nfs@vger.kernel.org, Andy Adamson , Fred Isaman Subject: Re: [PATCH] SQUASHME: pnfs: Fix NULL dereference in the -ENOMEM path References: <4DDA8C3D.5080706@panasas.com> <1306168714-11721-1-git-send-email-bhalevy@panasas.com> <4DDD2933.3000209@panasas.com> In-Reply-To: <4DDD2933.3000209@panasas.com> Content-Type: text/plain; charset=UTF-8 Sender: linux-nfs-owner@vger.kernel.org List-ID: MIME-Version: 1.0 On 05/25/2011 07:07 PM, Boaz Harrosh wrote: > > In _pnfs_return_layout: > > lrp pointer is checked for NULL after it was already accessed. > > The rational here is that in _pnfs_return_layout we want to > de-ref and release the layout regardless of if we sent the > return or not (forgetfull). An eventual recall can return -ENOMATCHING > instead of -EDELAY. > > So to keep the reasoning above, copy the stateid twice. > > Benny if it is OK to not release the layout on -ENOMEM then the check > could just be moved above the spin_lock(), and the put_layout_hdr removed. > > Signed-off-by: Boaz Harrosh > --- > fs/nfs/pnfs.c | 4 +++- > 1 files changed, 3 insertions(+), 1 deletions(-) > > diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c > index a07b007..c3ec577 100644 > --- a/fs/nfs/pnfs.c > +++ b/fs/nfs/pnfs.c > @@ -628,6 +628,7 @@ _pnfs_return_layout(struct inode *ino) > struct nfs_inode *nfsi = NFS_I(ino); > LIST_HEAD(tmp_list); > struct nfs4_layoutreturn *lrp; > + nfs4_stateid stateid; > int status = 0; > > dprintk("--> %s\n", __func__); > @@ -642,7 +643,7 @@ _pnfs_return_layout(struct inode *ino) > kfree(lrp); > goto out; Rrrr the lrp is leaked here > } > - lrp->args.stateid = nfsi->layout->plh_stateid; > + stateid = nfsi->layout->plh_stateid; > /* Reference matched in nfs4_layoutreturn_release */ > get_layout_hdr(lo); > spin_unlock(&ino->i_lock); > @@ -655,6 +656,7 @@ _pnfs_return_layout(struct inode *ino) > status = -ENOMEM; > goto out; > } > + lrp->args.stateid = stateid; > lrp->args.reclaim = 0; > lrp->args.layout_type = NFS_SERVER(ino)->pnfs_curr_ld->id; > lrp->args.inode = ino; I'll send a second squashme. Ignore that one please Boaz