Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fbdb9190 authored by Sage Weil's avatar Sage Weil
Browse files

libceph: fix null dereference when unregistering linger requests 



We should only clear r_osd if we are neither registered as a linger or a
regular request.  We may unregister as a linger while still registered as
a regular request (e.g., in reset_osd).  Incorrectly clearing r_osd there
leads to a null pointer dereference in __send_request.

Also simplify the parallel check in __unregister_request() where we just
removed r_osd_item and know it's empty.

Signed-off-by: default avatarSage Weil <sage@newdream.net>
parent 234af26f

net/ceph/osd_client.c

+3 −3
Original line number Diff line number Diff line
@@ -837,8 +837,7 @@ static void __unregister_request(struct ceph_osd_client *osdc, 
			dout("moving osd to %p lru\n", req->r_osd);

			__move_osd_to_lru(osdc, req->r_osd);

		}

		if (list_empty(&req->r_osd_item) &&

		    list_empty(&req->r_linger_item))

		if (list_empty(&req->r_linger_item))

			req->r_osd = NULL;

	}
@@ -883,6 +882,7 @@ static void __unregister_linger_request(struct ceph_osd_client *osdc, 
			dout("moving osd to %p lru\n", req->r_osd);

			__move_osd_to_lru(osdc, req->r_osd);

		}

		if (list_empty(&req->r_osd_item))

			req->r_osd = NULL;

	}

}