pNFS: Fix use after free issues in pnfs_do_read() (6aeafd05) · Commits · 戴 / test

The assumption should be that if the caller returns PNFS_ATTEMPTED, then hdr has been consumed, and so we should not be testing hdr->task.tk_status. If the caller returns PNFS_TRY_AGAIN, then we need to recoalesce and free hdr. Signed-off-by:

Trond Myklebust <trond.myklebust@primarydata.com>

fs/nfs/pnfs.c

+13 −3

Original line number	Diff line number	Diff line
		@@ -2419,10 +2419,20 @@ pnfs_do_read(struct nfs_pageio_descriptor desc, struct nfs_pgio_header hdr)
		enum pnfs_try_status trypnfs;

		trypnfs = pnfs_try_to_read_data(hdr, call_ops, lseg);
		if (trypnfs == PNFS_TRY_AGAIN)
		pnfs_read_resend_pnfs(hdr);
		if (trypnfs == PNFS_NOT_ATTEMPTED \|\| hdr->task.tk_status)
		switch (trypnfs) {
		case PNFS_NOT_ATTEMPTED:
		pnfs_read_through_mds(desc, hdr);
		case PNFS_ATTEMPTED:
		break;
		case PNFS_TRY_AGAIN:
		/* cleanup hdr and prepare to redo pnfs */
		if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags)) {
		struct nfs_pgio_mirror *mirror = nfs_pgio_current_mirror(desc);
		list_splice_init(&hdr->pages, &mirror->pg_list);
		mirror->pg_recoalesce = 1;
		}
		hdr->mds_ops->rpc_release(hdr);
		}
		}

		static void pnfs_readhdr_free(struct nfs_pgio_header *hdr)

Admin message