github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-08 14:42:37 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()

Browse Source 
commit a421d21860 upstream.

Commit de144ff423 changes _pnfs_return_layout() to call
pnfs_mark_matching_lsegs_return() passing NULL as the struct
pnfs_layout_range argument. Unfortunately,
pnfs_mark_matching_lsegs_return() doesn't check if we have a value here
before dereferencing it, causing an oops.

I'm able to hit this crash consistently when running connectathon basic
tests on NFS v4.1/v4.2 against Ontap.

Fixes: de144ff423 ("NFSv4: Don't discard segments marked for return in _pnfs_return_layout()")
Cc: stable@vger.kernel.org
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Anna Schumaker 2021-05-19 12:54:51 -04:00 committed by Greg Kroah-Hartman
parent 3e5b48d9e7
commit f989065218
1 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
fs/nfs/pnfs.c
View File

@ -1317,6 +1317,11 @@ _pnfs_return_layout(struct inode *ino)
{ {
struct pnfs_layout_hdr *lo = NULL; struct pnfs_layout_hdr *lo = NULL;
struct nfs_inode *nfsi = NFS_I(ino); struct nfs_inode *nfsi = NFS_I(ino);
struct pnfs_layout_range range = {
.iomode = IOMODE_ANY,
.offset = 0,
.length = NFS4_MAX_UINT64,
};
LIST_HEAD(tmp_list); LIST_HEAD(tmp_list);
const struct cred *cred; const struct cred *cred;
nfs4_stateid stateid; nfs4_stateid stateid;
@ -1344,16 +1349,10 @@ _pnfs_return_layout(struct inode *ino)
} }
valid_layout = pnfs_layout_is_valid(lo); valid_layout = pnfs_layout_is_valid(lo);
pnfs_clear_layoutcommit(ino, &tmp_list); pnfs_clear_layoutcommit(ino, &tmp_list);
pnfs_mark_matching_lsegs_return(lo, &tmp_list, NULL, 0); pnfs_mark_matching_lsegs_return(lo, &tmp_list, &range, 0);
if (NFS_SERVER(ino)->pnfs_curr_ld->return_range) { if (NFS_SERVER(ino)->pnfs_curr_ld->return_range)
struct pnfs_layout_range range = {
.iomode = IOMODE_ANY,
.offset = 0,
.length = NFS4_MAX_UINT64,
};
NFS_SERVER(ino)->pnfs_curr_ld->return_range(lo, &range); NFS_SERVER(ino)->pnfs_curr_ld->return_range(lo, &range);
}
/* Don't send a LAYOUTRETURN if list was initially empty */ /* Don't send a LAYOUTRETURN if list was initially empty */
if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) || if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) ||