Re: [PATCH] rbd: Clear ceph_msg->bio_iter for retransmitted message

[Alex Elder <elder@dreamhost.com>]

On 06/06/2012 03:03 AM, Yan, Zheng wrote:
> From: "Yan, Zheng" <zheng.z.yan@intel.com>
> 
> The bug can cause NULL pointer dereference in write_partial_msg_pages

Although this looks simple enough, I want to study it a little more
before committing it.  I've been wanting to walk through this bit
of code anyway so I'll do that today.

One quick observation though:  m->bio_iter really ought to be
initialized only within #ifdef CONFIG_BLOCK (although I see it's
defined without it in the structure definition).  At some point
I'll put together a cleanup patch to do that everywhere; feel free
to do that yourself if you are so inclined.

					-Alex

> Signed-off-by: Zheng Yan <zheng.z.yan@intel.com>
> ---
>  net/ceph/messenger.c |    1 +
>  1 files changed, 1 insertions(+), 0 deletions(-)
> 
> diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
> index 1a80907..785b953 100644
> --- a/net/ceph/messenger.c
> +++ b/net/ceph/messenger.c
> @@ -598,6 +598,7 @@ static void prepare_write_message(struct ceph_connection *con)
>  	     le32_to_cpu(con->out_msg->footer.front_crc),
>  	     le32_to_cpu(con->out_msg->footer.middle_crc));
>  
> +	m->bio_iter = NULL;
>  	/* is there a data payload? */
>  	if (le32_to_cpu(m->hdr.data_len) > 0) {
>  		/* initialize page iterator */