From: Ilya Dryomov <idryomov@gmail.com>
To: ceph-devel@vger.kernel.org
Cc: Alex Elder <elder@linaro.org>
Subject: [PATCH 8/8] rbd: img_data requests don't own their page array
Date: Mon, 19 Sep 2016 19:03:28 +0200 [thread overview]
Message-ID: <1474304608-17958-9-git-send-email-idryomov@gmail.com> (raw)
In-Reply-To: <1474304608-17958-1-git-send-email-idryomov@gmail.com>
Move the check into rbd_obj_request_destroy(), to avoid use-after-free
on errors in rbd_img_request_fill().
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
---
drivers/block/rbd.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 8907ee6342ac..d305b9ebe2cf 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -2139,7 +2139,9 @@ static void rbd_obj_request_destroy(struct kref *kref)
bio_chain_put(obj_request->bio_list);
break;
case OBJ_REQUEST_PAGES:
- if (obj_request->pages)
+ /* img_data requests don't own their page array */
+ if (obj_request->pages &&
+ !obj_request_img_data_test(obj_request))
ceph_release_page_vector(obj_request->pages,
obj_request->page_count);
break;
@@ -2360,13 +2362,6 @@ static bool rbd_img_obj_end_request(struct rbd_obj_request *obj_request)
xferred = obj_request->length;
}
- /* Image object requests don't own their page array */
-
- if (obj_request->type == OBJ_REQUEST_PAGES) {
- obj_request->pages = NULL;
- obj_request->page_count = 0;
- }
-
if (img_request_child_test(img_request)) {
rbd_assert(img_request->obj_request != NULL);
more = obj_request->which < img_request->obj_request_count - 1;
--
2.4.3
next prev parent reply other threads:[~2016-09-19 17:03 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-19 17:03 [PATCH 0/8] rbd: layering (mostly) error path fixes Ilya Dryomov
2016-09-19 17:03 ` [PATCH 1/8] rbd: change rbd_obj_request_submit() signature Ilya Dryomov
2016-09-23 15:38 ` Alex Elder
2016-09-26 12:38 ` David Disseldorp
2016-09-19 17:03 ` [PATCH 2/8] rbd: clean up asserts in rbd_img_obj_request_submit() helpers Ilya Dryomov
2016-09-23 15:57 ` Alex Elder
2016-09-23 16:07 ` Ilya Dryomov
2016-09-23 16:41 ` Alex Elder
2016-09-26 12:43 ` David Disseldorp
2016-09-19 17:03 ` [PATCH 3/8] rbd: mark the original request as done if stat request fails Ilya Dryomov
2016-09-23 21:39 ` Alex Elder
2016-09-26 12:28 ` Ilya Dryomov
2016-09-19 17:03 ` [PATCH 4/8] rbd: move bumping img_request refcount into rbd_obj_request_submit() Ilya Dryomov
2016-09-25 15:56 ` Alex Elder
2016-09-26 14:38 ` Ilya Dryomov
2016-09-28 0:22 ` Alex Elder
2016-09-29 15:15 ` Ilya Dryomov
2016-09-19 17:03 ` [PATCH 5/8] rbd: don't crash or leak on errors in rbd_img_obj_parent_read_full_callback() Ilya Dryomov
2016-09-25 16:02 ` Alex Elder
2016-09-26 12:58 ` David Disseldorp
2016-09-19 17:03 ` [PATCH 6/8] rbd: rework rbd_img_obj_exists_submit() error paths Ilya Dryomov
2016-09-25 16:30 ` Alex Elder
2016-09-26 12:05 ` David Disseldorp
2016-09-19 17:03 ` [PATCH 7/8] rbd: don't call rbd_osd_req_format_read() for !img_data requests Ilya Dryomov
2016-09-25 16:44 ` Alex Elder
2016-09-26 16:37 ` Ilya Dryomov
2016-09-27 17:11 ` Alex Elder
2016-09-26 12:05 ` David Disseldorp
2016-09-19 17:03 ` Ilya Dryomov [this message]
2016-09-25 17:06 ` [PATCH 8/8] rbd: img_data requests don't own their page array Alex Elder
2016-09-26 15:33 ` David Disseldorp
2016-09-26 17:25 ` Ilya Dryomov
2016-09-19 17:06 ` [PATCH 0/8] rbd: layering (mostly) error path fixes Alex Elder
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1474304608-17958-9-git-send-email-idryomov@gmail.com \
--to=idryomov@gmail.com \
--cc=ceph-devel@vger.kernel.org \
--cc=elder@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.