* [PATCH] ceph: Fix error handling in ceph_read_iter @ 2016-10-10 12:38 Nikolay Borisov 2016-10-10 12:56 ` [PATCHv2] " Nikolay Borisov 0 siblings, 1 reply; 7+ messages in thread From: Nikolay Borisov @ 2016-10-10 12:38 UTC (permalink / raw) To: zyan, idryomov; +Cc: ceph-devel, linux-kernel, Nikolay Borisov In case __ceph_do_getattr returns an error and the retry_op in ceph_read_iter is not READ_INLINE, then it's possible to invoke __free_page on a page which is NULL, this naturally leads to a crash. This can happen when, for example, a process waiting on a MDS reply receives sigterm. Fix this by explicitly checking whether the page is set or not. Signed-off-by: Nikolay Borisov <kernel@kyup.com> Link: http://www.spinics.net/lists/ceph-users/msg31592.html --- fs/ceph/file.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ceph/file.c b/fs/ceph/file.c index 3c68e6aee2f0..7413313ae6c8 100644 --- a/fs/ceph/file.c +++ b/fs/ceph/file.c @@ -929,7 +929,8 @@ again: statret = __ceph_do_getattr(inode, page, CEPH_STAT_CAP_INLINE_DATA, !!page); if (statret < 0) { - __free_page(page); + if (!page) + __free_page(page); if (statret == -ENODATA) { BUG_ON(retry_op != READ_INLINE); goto again; -- 2.5.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCHv2] ceph: Fix error handling in ceph_read_iter 2016-10-10 12:38 [PATCH] ceph: Fix error handling in ceph_read_iter Nikolay Borisov @ 2016-10-10 12:56 ` Nikolay Borisov 2016-10-10 13:11 ` Yan, Zheng 0 siblings, 1 reply; 7+ messages in thread From: Nikolay Borisov @ 2016-10-10 12:56 UTC (permalink / raw) To: zyan, idryomov; +Cc: ceph-devel, linux-kernel, Nikolay Borisov In case __ceph_do_getattr returns an error and the retry_op in ceph_read_iter is not READ_INLINE, then it's possible to invoke __free_page on a page which is NULL, this naturally leads to a crash. This can happen when, for example, a process waiting on a MDS reply receives sigterm. Fix this by explicitly checking whether the page is set or not. Signed-off-by: Nikolay Borisov <kernel@kyup.com> Link: http://www.spinics.net/lists/ceph-users/msg31592.html --- Inverted the condition, so resending with correct condition this time. fs/ceph/file.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ceph/file.c b/fs/ceph/file.c index 3c68e6aee2f0..7413313ae6c8 100644 --- a/fs/ceph/file.c +++ b/fs/ceph/file.c @@ -929,7 +929,8 @@ again: statret = __ceph_do_getattr(inode, page, CEPH_STAT_CAP_INLINE_DATA, !!page); if (statret < 0) { - __free_page(page); + if (page) + __free_page(page); if (statret == -ENODATA) { BUG_ON(retry_op != READ_INLINE); goto again; -- 2.5.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCHv2] ceph: Fix error handling in ceph_read_iter 2016-10-10 12:56 ` [PATCHv2] " Nikolay Borisov @ 2016-10-10 13:11 ` Yan, Zheng 2016-10-10 13:13 ` Nikolay Borisov 0 siblings, 1 reply; 7+ messages in thread From: Yan, Zheng @ 2016-10-10 13:11 UTC (permalink / raw) To: Nikolay Borisov; +Cc: Ilya Dryomov, ceph-devel, linux-kernel > On 10 Oct 2016, at 20:56, Nikolay Borisov <kernel@kyup.com> wrote: > > In case __ceph_do_getattr returns an error and the retry_op in > ceph_read_iter is not READ_INLINE, then it's possible to invoke > __free_page on a page which is NULL, this naturally leads to a crash. > This can happen when, for example, a process waiting on a MDS reply > receives sigterm. > > Fix this by explicitly checking whether the page is set or not. > > Signed-off-by: Nikolay Borisov <kernel@kyup.com> > Link: http://www.spinics.net/lists/ceph-users/msg31592.html > --- > > Inverted the condition, so resending with correct condition > this time. > > fs/ceph/file.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/ceph/file.c b/fs/ceph/file.c > index 3c68e6aee2f0..7413313ae6c8 100644 > --- a/fs/ceph/file.c > +++ b/fs/ceph/file.c > @@ -929,7 +929,8 @@ again: > statret = __ceph_do_getattr(inode, page, > CEPH_STAT_CAP_INLINE_DATA, !!page); > if (statret < 0) { > - __free_page(page); > + if (page) > + __free_page(page); > if (statret == -ENODATA) { > BUG_ON(retry_op != READ_INLINE); > goto again; > — Reviewed-by: Yan, Zheng <zyan@redhat.com> > 2.5.0 > ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCHv2] ceph: Fix error handling in ceph_read_iter 2016-10-10 13:11 ` Yan, Zheng @ 2016-10-10 13:13 ` Nikolay Borisov 2016-10-10 13:14 ` Yan, Zheng 2016-10-10 13:50 ` Ilya Dryomov 0 siblings, 2 replies; 7+ messages in thread From: Nikolay Borisov @ 2016-10-10 13:13 UTC (permalink / raw) To: Yan, Zheng; +Cc: Ilya Dryomov, ceph-devel, linux-kernel On 10/10/2016 04:11 PM, Yan, Zheng wrote: > >> On 10 Oct 2016, at 20:56, Nikolay Borisov <kernel@kyup.com> wrote: >> >> In case __ceph_do_getattr returns an error and the retry_op in >> ceph_read_iter is not READ_INLINE, then it's possible to invoke >> __free_page on a page which is NULL, this naturally leads to a crash. >> This can happen when, for example, a process waiting on a MDS reply >> receives sigterm. >> >> Fix this by explicitly checking whether the page is set or not. >> >> Signed-off-by: Nikolay Borisov <kernel@kyup.com> >> Link: http://www.spinics.net/lists/ceph-users/msg31592.html >> --- >> >> Inverted the condition, so resending with correct condition >> this time. >> >> fs/ceph/file.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/fs/ceph/file.c b/fs/ceph/file.c >> index 3c68e6aee2f0..7413313ae6c8 100644 >> --- a/fs/ceph/file.c >> +++ b/fs/ceph/file.c >> @@ -929,7 +929,8 @@ again: >> statret = __ceph_do_getattr(inode, page, >> CEPH_STAT_CAP_INLINE_DATA, !!page); >> if (statret < 0) { >> - __free_page(page); >> + if (page) >> + __free_page(page); >> if (statret == -ENODATA) { >> BUG_ON(retry_op != READ_INLINE); >> goto again; >> — > Reviewed-by: Yan, Zheng <zyan@redhat.com> I believe this needs to also be tagged as stable. To whomever is going to merge it: can you please do that? > >> 2.5.0 >> > ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCHv2] ceph: Fix error handling in ceph_read_iter 2016-10-10 13:13 ` Nikolay Borisov @ 2016-10-10 13:14 ` Yan, Zheng 2016-10-10 13:50 ` Ilya Dryomov 1 sibling, 0 replies; 7+ messages in thread From: Yan, Zheng @ 2016-10-10 13:14 UTC (permalink / raw) To: Nikolay Borisov; +Cc: Ilya Dryomov, ceph-devel, open list > On 10 Oct 2016, at 21:13, Nikolay Borisov <kernel@kyup.com> wrote: > > > > On 10/10/2016 04:11 PM, Yan, Zheng wrote: >> >>> On 10 Oct 2016, at 20:56, Nikolay Borisov <kernel@kyup.com> wrote: >>> >>> In case __ceph_do_getattr returns an error and the retry_op in >>> ceph_read_iter is not READ_INLINE, then it's possible to invoke >>> __free_page on a page which is NULL, this naturally leads to a crash. >>> This can happen when, for example, a process waiting on a MDS reply >>> receives sigterm. >>> >>> Fix this by explicitly checking whether the page is set or not. >>> >>> Signed-off-by: Nikolay Borisov <kernel@kyup.com> >>> Link: http://www.spinics.net/lists/ceph-users/msg31592.html >>> --- >>> >>> Inverted the condition, so resending with correct condition >>> this time. >>> >>> fs/ceph/file.c | 3 ++- >>> 1 file changed, 2 insertions(+), 1 deletion(-) >>> >>> diff --git a/fs/ceph/file.c b/fs/ceph/file.c >>> index 3c68e6aee2f0..7413313ae6c8 100644 >>> --- a/fs/ceph/file.c >>> +++ b/fs/ceph/file.c >>> @@ -929,7 +929,8 @@ again: >>> statret = __ceph_do_getattr(inode, page, >>> CEPH_STAT_CAP_INLINE_DATA, !!page); >>> if (statret < 0) { >>> - __free_page(page); >>> + if (page) >>> + __free_page(page); >>> if (statret == -ENODATA) { >>> BUG_ON(retry_op != READ_INLINE); >>> goto again; >>> — >> Reviewed-by: Yan, Zheng <zyan@redhat.com> > > I believe this needs to also be tagged as stable. To whomever is going > to merge it: can you please do that? > need to get it upstream first > >> >>> 2.5.0 >>> >> ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCHv2] ceph: Fix error handling in ceph_read_iter 2016-10-10 13:13 ` Nikolay Borisov 2016-10-10 13:14 ` Yan, Zheng @ 2016-10-10 13:50 ` Ilya Dryomov 2016-10-10 15:09 ` Yan, Zheng 1 sibling, 1 reply; 7+ messages in thread From: Ilya Dryomov @ 2016-10-10 13:50 UTC (permalink / raw) To: Nikolay Borisov; +Cc: Yan, Zheng, ceph-devel, linux-kernel@vger.kernel.org On Mon, Oct 10, 2016 at 3:13 PM, Nikolay Borisov <kernel@kyup.com> wrote: > > > On 10/10/2016 04:11 PM, Yan, Zheng wrote: >> >>> On 10 Oct 2016, at 20:56, Nikolay Borisov <kernel@kyup.com> wrote: >>> >>> In case __ceph_do_getattr returns an error and the retry_op in >>> ceph_read_iter is not READ_INLINE, then it's possible to invoke >>> __free_page on a page which is NULL, this naturally leads to a crash. >>> This can happen when, for example, a process waiting on a MDS reply >>> receives sigterm. >>> >>> Fix this by explicitly checking whether the page is set or not. >>> >>> Signed-off-by: Nikolay Borisov <kernel@kyup.com> >>> Link: http://www.spinics.net/lists/ceph-users/msg31592.html >>> --- >>> >>> Inverted the condition, so resending with correct condition >>> this time. >>> >>> fs/ceph/file.c | 3 ++- >>> 1 file changed, 2 insertions(+), 1 deletion(-) >>> >>> diff --git a/fs/ceph/file.c b/fs/ceph/file.c >>> index 3c68e6aee2f0..7413313ae6c8 100644 >>> --- a/fs/ceph/file.c >>> +++ b/fs/ceph/file.c >>> @@ -929,7 +929,8 @@ again: >>> statret = __ceph_do_getattr(inode, page, >>> CEPH_STAT_CAP_INLINE_DATA, !!page); >>> if (statret < 0) { >>> - __free_page(page); >>> + if (page) >>> + __free_page(page); >>> if (statret == -ENODATA) { >>> BUG_ON(retry_op != READ_INLINE); >>> goto again; >>> — >> Reviewed-by: Yan, Zheng <zyan@redhat.com> > > I believe this needs to also be tagged as stable. To whomever is going > to merge it: can you please do that? I'll do that. Zheng, do you see any other issues with the killable wait here? Thanks, Ilya ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCHv2] ceph: Fix error handling in ceph_read_iter 2016-10-10 13:50 ` Ilya Dryomov @ 2016-10-10 15:09 ` Yan, Zheng 0 siblings, 0 replies; 7+ messages in thread From: Yan, Zheng @ 2016-10-10 15:09 UTC (permalink / raw) To: Ilya Dryomov; +Cc: Nikolay Borisov, ceph-devel, linux-kernel@vger.kernel.org > On 10 Oct 2016, at 21:50, Ilya Dryomov <idryomov@gmail.com> wrote: > > On Mon, Oct 10, 2016 at 3:13 PM, Nikolay Borisov <kernel@kyup.com> wrote: >> >> >> On 10/10/2016 04:11 PM, Yan, Zheng wrote: >>> >>>> On 10 Oct 2016, at 20:56, Nikolay Borisov <kernel@kyup.com> wrote: >>>> >>>> In case __ceph_do_getattr returns an error and the retry_op in >>>> ceph_read_iter is not READ_INLINE, then it's possible to invoke >>>> __free_page on a page which is NULL, this naturally leads to a crash. >>>> This can happen when, for example, a process waiting on a MDS reply >>>> receives sigterm. >>>> >>>> Fix this by explicitly checking whether the page is set or not. >>>> >>>> Signed-off-by: Nikolay Borisov <kernel@kyup.com> >>>> Link: http://www.spinics.net/lists/ceph-users/msg31592.html >>>> --- >>>> >>>> Inverted the condition, so resending with correct condition >>>> this time. >>>> >>>> fs/ceph/file.c | 3 ++- >>>> 1 file changed, 2 insertions(+), 1 deletion(-) >>>> >>>> diff --git a/fs/ceph/file.c b/fs/ceph/file.c >>>> index 3c68e6aee2f0..7413313ae6c8 100644 >>>> --- a/fs/ceph/file.c >>>> +++ b/fs/ceph/file.c >>>> @@ -929,7 +929,8 @@ again: >>>> statret = __ceph_do_getattr(inode, page, >>>> CEPH_STAT_CAP_INLINE_DATA, !!page); >>>> if (statret < 0) { >>>> - __free_page(page); >>>> + if (page) >>>> + __free_page(page); >>>> if (statret == -ENODATA) { >>>> BUG_ON(retry_op != READ_INLINE); >>>> goto again; >>>> — >>> Reviewed-by: Yan, Zheng <zyan@redhat.com> >> >> I believe this needs to also be tagged as stable. To whomever is going >> to merge it: can you please do that? > > I'll do that. Zheng, do you see any other issues with the killable > wait here? No. this change is obvious, what’s your concern? Regards Yan, Zheng > > Thanks, > > Ilya ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2016-10-10 15:10 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2016-10-10 12:38 [PATCH] ceph: Fix error handling in ceph_read_iter Nikolay Borisov 2016-10-10 12:56 ` [PATCHv2] " Nikolay Borisov 2016-10-10 13:11 ` Yan, Zheng 2016-10-10 13:13 ` Nikolay Borisov 2016-10-10 13:14 ` Yan, Zheng 2016-10-10 13:50 ` Ilya Dryomov 2016-10-10 15:09 ` Yan, Zheng
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox