redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

ceph: fix null pointer dereference in discard_cap_releases() 

send_mds_reconnect() may call discard_cap_releases() after all
release messages have been dropped by cleanup_cap_releases()

Signed-off-by: Yan, Zheng <zheng.z.yan@intel.com>
Reviewed-by: Sage Weil <sage@inktank.com>
hifive-unleashed-5.1
Yan, Zheng 2014-03-24 09:56:43 +08:00 committed by Sage Weil
parent d90deda69c
commit 00bd8edb86
1 changed files with 12 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
fs/ceph/mds_client.c
View File

@ -1462,15 +1462,18 @@ static void discard_cap_releases(struct ceph_mds_client *mdsc,
dout("discard_cap_releases mds%d\n", session->s_mds); dout("discard_cap_releases mds%d\n", session->s_mds);
/* zero out the in-progress message */ if (!list_empty(&session->s_cap_releases)) {
msg = list_first_entry(&session->s_cap_releases, /* zero out the in-progress message */
struct ceph_msg, list_head); msg = list_first_entry(&session->s_cap_releases,
head = msg->front.iov_base; struct ceph_msg, list_head);
num = le32_to_cpu(head->num); head = msg->front.iov_base;
dout("discard_cap_releases mds%d %p %u\n", session->s_mds, msg, num); num = le32_to_cpu(head->num);
head->num = cpu_to_le32(0); dout("discard_cap_releases mds%d %p %u\n",
msg->front.iov_len = sizeof(*head); session->s_mds, msg, num);
session->s_num_cap_releases += num; head->num = cpu_to_le32(0);
msg->front.iov_len = sizeof(*head);
session->s_num_cap_releases += num;
}
/* requeue completed messages */ /* requeue completed messages */
while (!list_empty(&session->s_cap_releases_done)) { while (!list_empty(&session->s_cap_releases_done)) {