libceph: behave in mon_fault() if cur_mon < 0 (b5d91704) · Commits · 戴 / test

This can happen if __close_session() in ceph_monc_stop() races with a connection reset. We need to ignore such faults, otherwise it's likely we would take !hunting, call __schedule_delayed() and end up with delayed_work() executing on invalid memory, among other things. The (two!) con->private tests are useless, as nothing ever clears con->private. Nuke them. Signed-off-by:

Ilya Dryomov <idryomov@gmail.com>

net/ceph/mon_client.c

+9 −14

Original line number	Diff line number	Diff line
		@@ -1155,14 +1155,9 @@ static void mon_fault(struct ceph_connection *con)
		{
		struct ceph_mon_client *monc = con->private;

		if (!monc)
		return;

		dout("mon_fault\n");
		mutex_lock(&monc->mutex);
		if (!con->private)
		goto out;

		dout("%s mon%d\n", __func__, monc->cur_mon);
		if (monc->cur_mon >= 0) {
		if (!monc->hunting) {
		dout("%s hunting for new mon\n", __func__);
		reopen_session(monc);
		@@ -1170,7 +1165,7 @@ static void mon_fault(struct ceph_connection *con)
		} else {
		dout("%s already hunting\n", __func__);
		}
		out:
		}
		mutex_unlock(&monc->mutex);
		}

Admin message