On Mon, Oct 10, 2016 at 3:13 PM, Nikolay Borisov <kernel@xxxxxxxx> wrote: > > > On 10/10/2016 04:11 PM, Yan, Zheng wrote: >> >>> On 10 Oct 2016, at 20:56, Nikolay Borisov <kernel@xxxxxxxx> wrote: >>> >>> In case __ceph_do_getattr returns an error and the retry_op in >>> ceph_read_iter is not READ_INLINE, then it's possible to invoke >>> __free_page on a page which is NULL, this naturally leads to a crash. >>> This can happen when, for example, a process waiting on a MDS reply >>> receives sigterm. >>> >>> Fix this by explicitly checking whether the page is set or not. >>> >>> Signed-off-by: Nikolay Borisov <kernel@xxxxxxxx> >>> Link: http://www.spinics.net/lists/ceph-users/msg31592.html >>> --- >>> >>> Inverted the condition, so resending with correct condition >>> this time. >>> >>> fs/ceph/file.c | 3 ++- >>> 1 file changed, 2 insertions(+), 1 deletion(-) >>> >>> diff --git a/fs/ceph/file.c b/fs/ceph/file.c >>> index 3c68e6aee2f0..7413313ae6c8 100644 >>> --- a/fs/ceph/file.c >>> +++ b/fs/ceph/file.c >>> @@ -929,7 +929,8 @@ again: >>> statret = __ceph_do_getattr(inode, page, >>> CEPH_STAT_CAP_INLINE_DATA, !!page); >>> if (statret < 0) { >>> - __free_page(page); >>> + if (page) >>> + __free_page(page); >>> if (statret == -ENODATA) { >>> BUG_ON(retry_op != READ_INLINE); >>> goto again; >>> — >> Reviewed-by: Yan, Zheng <zyan@xxxxxxxxxx> > > I believe this needs to also be tagged as stable. To whomever is going > to merge it: can you please do that? I'll do that. Zheng, do you see any other issues with the killable wait here? Thanks, Ilya -- To unsubscribe from this list: send the line "unsubscribe ceph-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
