Re: [PATCH 07/14] libceph: unregister only registered linger requests

[Alex Elder <elder@ieee.org>]

On 06/25/2014 12:16 PM, Ilya Dryomov wrote:
> Linger requests that have not yet been registered should not be
> unregistered by __unregister_linger_request().  This messes up ref
> count and leads to use-after-free.

This makes sense.  The problem can occur when updating the OSD
map.  An OSD *client* has its list of linger requests, but they
are not all necessarily registered as associated with the *OSD*.
So the __unregister_linger_request() call in kick_requests()
might pass a not-yet-registered linger request.

It could also occur if a client (like RBD) gets an error after
setting a request to linger but the request has completed
successfully.

Anyway, looks good.  This explains why the rename of the
r_linger_osd_item field was helpful.

Reviewed-by: Alex Elder <elder@linaro.org>

> 
> Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com>
> ---
>  net/ceph/osd_client.c |   15 +++++++++++++--
>  1 file changed, 13 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
> index a9b7ea7bfdc6..12ec553a7e76 100644
> --- a/net/ceph/osd_client.c
> +++ b/net/ceph/osd_client.c
> @@ -1248,7 +1248,9 @@ static void __cancel_request(struct ceph_osd_request *req)
>  static void __register_linger_request(struct ceph_osd_client *osdc,
>  				    struct ceph_osd_request *req)
>  {
> -	dout("__register_linger_request %p\n", req);
> +	dout("%s %p tid %llu\n", __func__, req, req->r_tid);
> +	WARN_ON(!req->r_linger);
> +
>  	ceph_osdc_get_request(req);
>  	list_add_tail(&req->r_linger_item, &osdc->req_linger);
>  	if (req->r_osd)
> @@ -1259,8 +1261,17 @@ static void __register_linger_request(struct ceph_osd_client *osdc,
>  static void __unregister_linger_request(struct ceph_osd_client *osdc,
>  					struct ceph_osd_request *req)
>  {
> -	dout("__unregister_linger_request %p\n", req);
> +	WARN_ON(!req->r_linger);
> +
> +	if (list_empty(&req->r_linger_item)) {
> +		dout("%s %p tid %llu not registered\n", __func__, req,
> +		     req->r_tid);
> +		return;
> +	}
> +
> +	dout("%s %p tid %llu\n", __func__, req, req->r_tid);
>  	list_del_init(&req->r_linger_item);
> +
>  	if (req->r_osd) {
>  		list_del_init(&req->r_linger_osd_item);
>  		maybe_move_osd_to_lru(osdc, req->r_osd);
>