[PATCH] PNFS: filelayout_commit corrupts RPC all_tasks

Tom Tucker

author

2007-09-05 18:04 UTC #0 lore raw

PATCH 1/1 PNFS: filelayout_commit corrupts RPC all_tasks

The filelayout_commit function incorrectly releases the nfs_write_data pointed to by 'data'. Basically, the task contained in the nfs_write_data structure has already been initialized (rpc_init_task) up in the generic NFS commit logic. Calling nfs4_commit_free frees the memory, but doesn't remove the task from the RPC all_tasks list. With debug turned on, the task list is corrupted immediately by poison_obj; without debug, a freed task is sitting on the all_tasks list and will eventually be corrupted when the memory is reused.

Signed-off-by Tom Tucker <[email protected]>

---

 fs/nfs/nfs4filelayout.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

fs/nfs/nfs4filelayout.c +1 -1

index 86ced63..1a32925 100644
@@ -583,7 +583,7 @@ filelayout_commit(struct pnfs_layout_typ
 	}
 
 	/* Release original commit data since it is not used */
-	nfs4_commit_free(data);
+	rpc_release_task(&data->task);
 	return 0;
 
 out_bad:

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

J. Bruce Fields

2007-09-05 18:18 UTC #1 lore raw

Quoted 2 lines · Tom Tucker

The filelayout_commit function incorrectly releases the nfs_write_data pointed to by 'data'.

Probably we should continue to keep discussion of the pnfs implementation on [email protected] for now.

--b.

Basically, the task contained in the nfs_write_data

Quoted 29 lines

structure has already been initialized (rpc_init_task) up in the generic NFS commit logic. Calling nfs4_commit_free frees the memory, but doesn't remove the task from the RPC all_tasks list. With debug turned on, the task list is corrupted immediately by poison_obj; without debug, a freed task is sitting on the all_tasks list and will eventually be corrupted when the memory is reused.
Signed-off-by Tom Tucker <[email protected]>
---
 fs/nfs/nfs4filelayout.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
fs/nfs/nfs4filelayout.c +1 -2
index 86ced63..1a32925 100644
@@ -583,7 +583,7 @@ filelayout_commit(struct pnfs_layout_typ
 	}
 
 	/* Release original commit data since it is not used */
-	nfs4_commit_free(data);
+	rpc_release_task(&data->task);
 	return 0;
 
 out_bad:
 
 
-------------------------------------------------------------------------

Quoted 7 lines

This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

Tom Tucker

author

2007-09-05 18:45 UTC #2 lore raw

Quoted 7 lines · J. Bruce Fields

Quoted 2 lines · Tom Tucker
The filelayout_commit function incorrectly releases the nfs_write_data pointed to by 'data'.
Probably we should continue to keep discussion of the pnfs implementation on [email protected] for now.

Oops, finger fumble. I'll repost.

Quoted 31 lines

--b.
Basically, the task contained in the nfs_write_data
Quoted 28 lines
structure has already been initialized (rpc_init_task) up in the generic NFS commit logic. Calling nfs4_commit_free frees the memory, but doesn't remove the task from the RPC all_tasks list. With debug turned on, the task list is corrupted immediately by poison_obj; without debug, a freed task is sitting on the all_tasks list and will eventually be corrupted when the memory is reused.
Signed-off-by Tom Tucker <[email protected]>
---
 fs/nfs/nfs4filelayout.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
fs/nfs/nfs4filelayout.c +1 -1
index 86ced63..1a32925 100644
@@ -583,7 +583,7 @@ filelayout_commit(struct pnfs_layout_typ
 	}
 
 	/* Release original commit data since it is not used */
-	nfs4_commit_free(data);
+	rpc_release_task(&data->task);
 	return 0;
 
 out_bad:

Quoted 8 lines

Quoted 8 lines
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs