Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6aeafd05 authored by Trond Myklebust's avatar Trond Myklebust
Browse files

pNFS: Fix use after free issues in pnfs_do_read() 



The assumption should be that if the caller returns PNFS_ATTEMPTED, then hdr
has been consumed, and so we should not be testing hdr->task.tk_status.
If the caller returns PNFS_TRY_AGAIN, then we need to recoalesce and
free hdr.

Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
parent b3230e80

fs/nfs/pnfs.c

+13 −3
Original line number Diff line number Diff line
@@ -2419,10 +2419,20 @@ pnfs_do_read(struct nfs_pageio_descriptor *desc, struct nfs_pgio_header *hdr) 
	enum pnfs_try_status trypnfs;



	trypnfs = pnfs_try_to_read_data(hdr, call_ops, lseg);

	if (trypnfs == PNFS_TRY_AGAIN)

		pnfs_read_resend_pnfs(hdr);

	if (trypnfs == PNFS_NOT_ATTEMPTED || hdr->task.tk_status)

	switch (trypnfs) {

	case PNFS_NOT_ATTEMPTED:

		pnfs_read_through_mds(desc, hdr);

	case PNFS_ATTEMPTED:

		break;

	case PNFS_TRY_AGAIN:

		/* cleanup hdr and prepare to redo pnfs */

		if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags)) {

			struct nfs_pgio_mirror *mirror = nfs_pgio_current_mirror(desc);

			list_splice_init(&hdr->pages, &mirror->pg_list);

			mirror->pg_recoalesce = 1;

		}

		hdr->mds_ops->rpc_release(hdr);

	}

}



static void pnfs_readhdr_free(struct nfs_pgio_header *hdr)