From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: Trond Myklebust , Sasha Levin Subject: [PATCH AUTOSEL for 4.9 086/190] pNFS: Fix use after free issues in pnfs_do_read() Date: Thu, 8 Mar 2018 04:59:29 +0000 Message-ID: <20180308045810.8041-86-alexander.levin@microsoft.com> References: <20180308045810.8041-1-alexander.levin@microsoft.com> In-Reply-To: <20180308045810.8041-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: From: Trond Myklebust [ Upstream commit 6aeafd05eca9bc8ab6b03d7e56d09ffd18190f44 ] The assumption should be that if the caller returns PNFS_ATTEMPTED, then hd= r has been consumed, and so we should not be testing hdr->task.tk_status. If the caller returns PNFS_TRY_AGAIN, then we need to recoalesce and free hdr. Signed-off-by: Trond Myklebust Signed-off-by: Sasha Levin --- fs/nfs/pnfs.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c index b8e44746f761..e9a697e9d292 100644 --- a/fs/nfs/pnfs.c +++ b/fs/nfs/pnfs.c @@ -2308,10 +2308,20 @@ pnfs_do_read(struct nfs_pageio_descriptor *desc, st= ruct nfs_pgio_header *hdr) enum pnfs_try_status trypnfs; =20 trypnfs =3D pnfs_try_to_read_data(hdr, call_ops, lseg); - if (trypnfs =3D=3D PNFS_TRY_AGAIN) - pnfs_read_resend_pnfs(hdr); - if (trypnfs =3D=3D PNFS_NOT_ATTEMPTED || hdr->task.tk_status) + switch (trypnfs) { + case PNFS_NOT_ATTEMPTED: pnfs_read_through_mds(desc, hdr); + case PNFS_ATTEMPTED: + break; + case PNFS_TRY_AGAIN: + /* cleanup hdr and prepare to redo pnfs */ + if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags)) { + struct nfs_pgio_mirror *mirror =3D nfs_pgio_current_mirror(desc); + list_splice_init(&hdr->pages, &mirror->pg_list); + mirror->pg_recoalesce =3D 1; + } + hdr->mds_ops->rpc_release(hdr); + } } =20 static void pnfs_readhdr_free(struct nfs_pgio_header *hdr) --=20 2.14.1