[PATCH] PNFS: filelayout_commit corrupts RPC all_tasks

[PATCH] PNFS: filelayout_commit corrupts RPC all_tasks

[Tom Tucker]

The filelayout_commit function incorrectly releases the nfs_write_data 
pointed to by 'data'. Basically, the task contained in the nfs_write_data 
structure has already been initialized (rpc_init_task) up in the generic NFS
commit logic. Calling nfs4_commit_free frees the memory, but doesn't remove 
the task from the RPC all_tasks list. With debug turned on, the task list 
is corrupted immediately by poison_obj; without debug, a freed task is 
sitting on the all_tasks list and will eventually be corrupted when the 
memory is reused.

Signed-off-by: Tom Tucker <tom@opengridcomputing.com>
---

 fs/nfs/nfs4filelayout.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index 86ced63..1a32925 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -583,7 +583,7 @@ filelayout_commit(struct pnfs_layout_typ
 	}
 
 	/* Release original commit data since it is not used */
-	nfs4_commit_free(data);
+	rpc_release_task(&data->task);
 	return 0;
 
 out_bad:


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: [PATCH] PNFS: filelayout_commit corrupts RPC all_tasks

[J. Bruce Fields]

On Wed, Sep 05, 2007 at 01:03:18PM -0500, Tom Tucker wrote:
> The filelayout_commit function incorrectly releases the nfs_write_data 
> pointed to by 'data'.

Probably we should continue to keep discussion of the pnfs
implementation on pnfs@linux-nfs.org for now.

--b.

Basically, the task contained in the nfs_write_data 
> structure has already been initialized (rpc_init_task) up in the generic NFS
> commit logic. Calling nfs4_commit_free frees the memory, but doesn't remove 
> the task from the RPC all_tasks list. With debug turned on, the task list 
> is corrupted immediately by poison_obj; without debug, a freed task is 
> sitting on the all_tasks list and will eventually be corrupted when the 
> memory is reused.
> 
> Signed-off-by: Tom Tucker <tom@opengridcomputing.com>
> ---
> 
>  fs/nfs/nfs4filelayout.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
> index 86ced63..1a32925 100644
> --- a/fs/nfs/nfs4filelayout.c
> +++ b/fs/nfs/nfs4filelayout.c
> @@ -583,7 +583,7 @@ filelayout_commit(struct pnfs_layout_typ
>  	}
>  
>  	/* Release original commit data since it is not used */
> -	nfs4_commit_free(data);
> +	rpc_release_task(&data->task);
>  	return 0;
>  
>  out_bad:
> 
> 
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >>  http://get.splunk.com/
> _______________________________________________
> NFS maillist  -  NFS@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nfs

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: [PATCH] PNFS: filelayout_commit corrupts RPC all_tasks

[Tom Tucker]

On Wed, 2007-09-05 at 14:17 -0400, J. Bruce Fields wrote:
> On Wed, Sep 05, 2007 at 01:03:18PM -0500, Tom Tucker wrote:
> > The filelayout_commit function incorrectly releases the nfs_write_data 
> > pointed to by 'data'.
> 
> Probably we should continue to keep discussion of the pnfs
> implementation on pnfs@linux-nfs.org for now.
> 

Oops, finger fumble. I'll repost.

> --b.
> 
> Basically, the task contained in the nfs_write_data 
> > structure has already been initialized (rpc_init_task) up in the generic NFS
> > commit logic. Calling nfs4_commit_free frees the memory, but doesn't remove 
> > the task from the RPC all_tasks list. With debug turned on, the task list 
> > is corrupted immediately by poison_obj; without debug, a freed task is 
> > sitting on the all_tasks list and will eventually be corrupted when the 
> > memory is reused.
> > 
> > Signed-off-by: Tom Tucker <tom@opengridcomputing.com>
> > ---
> > 
> >  fs/nfs/nfs4filelayout.c |    2 +-
> >  1 files changed, 1 insertions(+), 1 deletions(-)
> > 
> > diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
> > index 86ced63..1a32925 100644
> > --- a/fs/nfs/nfs4filelayout.c
> > +++ b/fs/nfs/nfs4filelayout.c
> > @@ -583,7 +583,7 @@ filelayout_commit(struct pnfs_layout_typ
> >  	}
> >  
> >  	/* Release original commit data since it is not used */
> > -	nfs4_commit_free(data);
> > +	rpc_release_task(&data->task);
> >  	return 0;
> >  
> >  out_bad:
> > 
> > 
> > -------------------------------------------------------------------------
> > This SF.net email is sponsored by: Splunk Inc.
> > Still grepping through log files to find problems?  Stop.
> > Now Search log events and configuration files using AJAX and a browser.
> > Download your FREE copy of Splunk now >>  http://get.splunk.com/
> > _______________________________________________
> > NFS maillist  -  NFS@lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/nfs


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs