Ilya Dryomov 6af167fbe6 libceph: fix double __remove_osd() problem ... commit 7eb71e0351 upstream. It turns out it's possible to get __remove_osd() called twice on the same OSD. That doesn't sit well with rb_erase() - depending on the shape of the tree we can get a NULL dereference, a soft lockup or a random crash at some point in the future as we end up touching freed memory. One scenario that I was able to reproduce is as follows: <osd3 is idle, on the osd lru list> <con reset - osd3> con_fault_finish() osd_reset() <osdmap - osd3 down> ceph_osdc_handle_map() <takes map_sem> kick_requests() <takes request_mutex> reset_changed_osds() __reset_osd() __remove_osd() <releases request_mutex> <releases map_sem> <takes map_sem> <takes request_mutex> __kick_osd_requests() __reset_osd() __remove_osd() <-- !!! A case can be made that osd refcounting is imperfect and reworking it would be a proper resolution, but for now Sage and I decided to fix this by adding a safe guard around __remove_osd(). Fixes: http://tracker.ceph.com/issues/8087 Cc: Sage Weil <sage@redhat.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Sage Weil <sage@redhat.com> Reviewed-by: Alex Elder <elder@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2015-03-06 14:40:54 -08:00
..
crush
armor.c
auth_none.c
auth_none.h
auth_x_protocol.h
auth_x.c	libceph: do not hard code max auth ticket len	2014-09-17 09:04:01 -07:00
auth_x.h
auth.c
buffer.c
ceph_common.c
ceph_fs.c
ceph_hash.c
ceph_strings.c
crypto.c	libceph: do not crash on large auth tickets	2014-11-21 09:22:53 -08:00
crypto.h
debugfs.c
Kconfig
Makefile
messenger.c	libceph: ceph-msgr workqueue needs a resque worker	2014-11-14 08:48:01 -08:00
mon_client.c	libceph: gracefully handle large reply messages from the mon	2014-09-17 09:04:02 -07:00
msgpool.c
osd_client.c	libceph: fix double __remove_osd() problem	2015-03-06 14:40:54 -08:00
osdmap.c
pagelist.c
pagevec.c
snapshot.c