[PATCH] libceph: fix ceph_msg_new error path

[PATCH] libceph: fix ceph_msg_new error path

[Henry C Chang]

If memory allocation failed, calling ceph_msg_put() will cause GPF
since some of ceph_msg variables are not initialized first.

Fix Bug #970.

Signed-off-by: Henry C Chang <henry_c_chang@tcloudcomputing.com>
---
 net/ceph/messenger.c |   26 +++++++++++++-------------
 1 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 05f3578..e15a82c 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -2267,6 +2267,19 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags)
 	m->more_to_follow = false;
 	m->pool = NULL;
 
+	/* middle */
+	m->middle = NULL;
+
+	/* data */
+	m->nr_pages = 0;
+	m->page_alignment = 0;
+	m->pages = NULL;
+	m->pagelist = NULL;
+	m->bio = NULL;
+	m->bio_iter = NULL;
+	m->bio_seg = 0;
+	m->trail = NULL;
+
 	/* front */
 	if (front_len) {
 		if (front_len > PAGE_CACHE_SIZE) {
@@ -2286,19 +2299,6 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags)
 	}
 	m->front.iov_len = front_len;
 
-	/* middle */
-	m->middle = NULL;
-
-	/* data */
-	m->nr_pages = 0;
-	m->page_alignment = 0;
-	m->pages = NULL;
-	m->pagelist = NULL;
-	m->bio = NULL;
-	m->bio_iter = NULL;
-	m->bio_seg = 0;
-	m->trail = NULL;
-
 	dout("ceph_msg_new %p front %d\n", m, front_len);
 	return m;
 
-- 
1.7.2.3

Re: [PATCH] libceph: fix ceph_msg_new error path

[Sage Weil]

Applied, thanks!

On Tue, 3 May 2011, Henry C Chang wrote:

> If memory allocation failed, calling ceph_msg_put() will cause GPF
> since some of ceph_msg variables are not initialized first.
> 
> Fix Bug #970.
> 
> Signed-off-by: Henry C Chang <henry_c_chang@tcloudcomputing.com>
> ---
>  net/ceph/messenger.c |   26 +++++++++++++-------------
>  1 files changed, 13 insertions(+), 13 deletions(-)
> 
> diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
> index 05f3578..e15a82c 100644
> --- a/net/ceph/messenger.c
> +++ b/net/ceph/messenger.c
> @@ -2267,6 +2267,19 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags)
>  	m->more_to_follow = false;
>  	m->pool = NULL;
>  
> +	/* middle */
> +	m->middle = NULL;
> +
> +	/* data */
> +	m->nr_pages = 0;
> +	m->page_alignment = 0;
> +	m->pages = NULL;
> +	m->pagelist = NULL;
> +	m->bio = NULL;
> +	m->bio_iter = NULL;
> +	m->bio_seg = 0;
> +	m->trail = NULL;
> +
>  	/* front */
>  	if (front_len) {
>  		if (front_len > PAGE_CACHE_SIZE) {
> @@ -2286,19 +2299,6 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags)
>  	}
>  	m->front.iov_len = front_len;
>  
> -	/* middle */
> -	m->middle = NULL;
> -
> -	/* data */
> -	m->nr_pages = 0;
> -	m->page_alignment = 0;
> -	m->pages = NULL;
> -	m->pagelist = NULL;
> -	m->bio = NULL;
> -	m->bio_iter = NULL;
> -	m->bio_seg = 0;
> -	m->trail = NULL;
> -
>  	dout("ceph_msg_new %p front %d\n", m, front_len);
>  	return m;
>  
> -- 
> 1.7.2.3
> 
> --
> To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
> 

Re: [PATCH] libceph: fix ceph_msg_new error path

[Tommi Virtanen]

On Tue, May 03, 2011 at 02:29:56AM +0000, Henry C Chang wrote:
> If memory allocation failed, calling ceph_msg_put() will cause GPF
> since some of ceph_msg variables are not initialized first.
> 
> Fix Bug #970.

Looks good and explains the symptoms perfectly. Committed to
ceph-client.git as 56f63aeb6360fb3ba9584bd5b094d55283a9e332.
Thanks!

-- 
:(){ :|:&};:

Re: [PATCH] libceph: fix ceph_msg_new error path

[Tommi Virtanen]

On Tue, May 03, 2011 at 09:14:31AM -0700, Tommi Virtanen wrote:
> On Tue, May 03, 2011 at 02:29:56AM +0000, Henry C Chang wrote:
> > If memory allocation failed, calling ceph_msg_put() will cause GPF
> > since some of ceph_msg variables are not initialized first.
> > 
> > Fix Bug #970.
> 
> Looks good and explains the symptoms perfectly. Committed to
> ceph-client.git as 56f63aeb6360fb3ba9584bd5b094d55283a9e332.
> Thanks!

I backed that out in favor of Sage's commits to for-linus. Sorry about
the confusion.

-- 
:(){ :|:&};: