Patch "pNFS: Fix use after free issues in pnfs_do_read()" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

pNFS: Fix use after free issues in pnfs_do_read()

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
pnfs-fix-use-after-free-issues-in-pnfs_do_read.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Trond Myklebust <[email protected]>
Date: Tue, 25 Apr 2017 11:26:53 -0400
Subject: pNFS: Fix use after free issues in pnfs_do_read()

From: Trond Myklebust <[email protected]>

[ Upstream commit 6aeafd05eca9bc8ab6b03d7e56d09ffd18190f44 ]

The assumption should be that if the caller returns PNFS_ATTEMPTED, then hdr has been consumed, and so we should not be testing hdr->task.tk_status. If the caller returns PNFS_TRY_AGAIN, then we need to recoalesce and free hdr.

---
 fs/nfs/pnfs.c |   16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

@@ -2308,10 +2308,20 @@ pnfs_do_read(struct nfs_pageio_descripto
 	enum pnfs_try_status trypnfs;
 
 	trypnfs = pnfs_try_to_read_data(hdr, call_ops, lseg);
-	if (trypnfs == PNFS_TRY_AGAIN)
-		pnfs_read_resend_pnfs(hdr);
-	if (trypnfs == PNFS_NOT_ATTEMPTED || hdr->task.tk_status)
+	switch (trypnfs) {
+	case PNFS_NOT_ATTEMPTED:
 		pnfs_read_through_mds(desc, hdr);
+	case PNFS_ATTEMPTED:
+		break;
+	case PNFS_TRY_AGAIN:
+		/* cleanup hdr and prepare to redo pnfs */
+		if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags)) {
+			struct nfs_pgio_mirror *mirror = nfs_pgio_current_mirror(desc);
+			list_splice_init(&hdr->pages, &mirror->pg_list);
+			mirror->pg_recoalesce = 1;
+		}
+		hdr->mds_ops->rpc_release(hdr);
+	}
 }
 
 static void pnfs_readhdr_free(struct nfs_pgio_header *hdr)

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/pnfs-fix-use-after-free-issues-in-pnfs_do_read.patch queue-4.9/pnfs-fix-a-deadlock-when-coalescing-writes-and-returning-the-layout.patch queue-4.9/nfs-fix-missing-pg_cleanup-after-nfs_pageio_cond_complete.patch