mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-13 14:14:37 +00:00
NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()
commita421d21860
upstream. Commitde144ff423
changes _pnfs_return_layout() to call pnfs_mark_matching_lsegs_return() passing NULL as the struct pnfs_layout_range argument. Unfortunately, pnfs_mark_matching_lsegs_return() doesn't check if we have a value here before dereferencing it, causing an oops. I'm able to hit this crash consistently when running connectathon basic tests on NFS v4.1/v4.2 against Ontap. Fixes:de144ff423
("NFSv4: Don't discard segments marked for return in _pnfs_return_layout()") Cc: stable@vger.kernel.org Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
f2a35ade22
commit
aba3c7795f
1 changed files with 7 additions and 8 deletions
|
@ -1285,6 +1285,11 @@ _pnfs_return_layout(struct inode *ino)
|
|||
{
|
||||
struct pnfs_layout_hdr *lo = NULL;
|
||||
struct nfs_inode *nfsi = NFS_I(ino);
|
||||
struct pnfs_layout_range range = {
|
||||
.iomode = IOMODE_ANY,
|
||||
.offset = 0,
|
||||
.length = NFS4_MAX_UINT64,
|
||||
};
|
||||
LIST_HEAD(tmp_list);
|
||||
nfs4_stateid stateid;
|
||||
int status = 0;
|
||||
|
@ -1311,16 +1316,10 @@ _pnfs_return_layout(struct inode *ino)
|
|||
}
|
||||
valid_layout = pnfs_layout_is_valid(lo);
|
||||
pnfs_clear_layoutcommit(ino, &tmp_list);
|
||||
pnfs_mark_matching_lsegs_return(lo, &tmp_list, NULL, 0);
|
||||
pnfs_mark_matching_lsegs_return(lo, &tmp_list, &range, 0);
|
||||
|
||||
if (NFS_SERVER(ino)->pnfs_curr_ld->return_range) {
|
||||
struct pnfs_layout_range range = {
|
||||
.iomode = IOMODE_ANY,
|
||||
.offset = 0,
|
||||
.length = NFS4_MAX_UINT64,
|
||||
};
|
||||
if (NFS_SERVER(ino)->pnfs_curr_ld->return_range)
|
||||
NFS_SERVER(ino)->pnfs_curr_ld->return_range(lo, &range);
|
||||
}
|
||||
|
||||
/* Don't send a LAYOUTRETURN if list was initially empty */
|
||||
if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) ||
|
||||
|
|
Loading…
Reference in a new issue