[PATCH] rbd: do a safe list traversal in rbd_img_request_submit()

[PATCH] rbd: do a safe list traversal in rbd_img_request_submit()

[Alex Elder]

It's possible that the reference to the object request dropped
inside the loop in rbd_img_request_submit() will be the last
one, in which case the content of the object pointer can't be
trusted.

Use a safe form of the object request list traversal to avoid
problems.

This resolves:
    http://tracker.ceph.com/issues/4705

Signed-off-by: Alex Elder <elder@inktank.com>
---
 drivers/block/rbd.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 3c0abe6..7eb1032 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -1652,9 +1652,10 @@ static int rbd_img_request_submit(struct
rbd_img_request *img_request)
 	struct rbd_device *rbd_dev = img_request->rbd_dev;
 	struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
 	struct rbd_obj_request *obj_request;
+	struct rbd_obj_request *next_obj_request;

 	dout("%s: img %p\n", __func__, img_request);
-	for_each_obj_request(img_request, obj_request) {
+	for_each_obj_request_safe(img_request, obj_request, next_obj_request) {
 		int ret;

 		ret = rbd_obj_request_submit(osdc, obj_request);
-- 
1.7.9.5

Re: [PATCH] rbd: do a safe list traversal in rbd_img_request_submit()

[Josh Durgin]

Reviewed-by: Josh Durgin <josh.durgin@inktank.com>

On 04/10/2013 03:49 PM, Alex Elder wrote:
> It's possible that the reference to the object request dropped
> inside the loop in rbd_img_request_submit() will be the last
> one, in which case the content of the object pointer can't be
> trusted.
>
> Use a safe form of the object request list traversal to avoid
> problems.
>
> This resolves:
>      http://tracker.ceph.com/issues/4705
>
> Signed-off-by: Alex Elder <elder@inktank.com>
> ---
>   drivers/block/rbd.c |    3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
> index 3c0abe6..7eb1032 100644
> --- a/drivers/block/rbd.c
> +++ b/drivers/block/rbd.c
> @@ -1652,9 +1652,10 @@ static int rbd_img_request_submit(struct
> rbd_img_request *img_request)
>   	struct rbd_device *rbd_dev = img_request->rbd_dev;
>   	struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
>   	struct rbd_obj_request *obj_request;
> +	struct rbd_obj_request *next_obj_request;
>
>   	dout("%s: img %p\n", __func__, img_request);
> -	for_each_obj_request(img_request, obj_request) {
> +	for_each_obj_request_safe(img_request, obj_request, next_obj_request) {
>   		int ret;
>
>   		ret = rbd_obj_request_submit(osdc, obj_request);
>