On 05/25/2011 07:07 PM, Boaz Harrosh wrote:
>
> In _pnfs_return_layout:
>
> lrp pointer is checked for NULL after it was already accessed.
>
> The rational here is that in _pnfs_return_layout we want to
> de-ref and release the layout regardless of if we sent the
> return or not (forgetfull). An eventual recall can return -ENOMATCHING
> instead of -EDELAY.
>
> So to keep the reasoning above, copy the stateid twice.
>
> Benny if it is OK to not release the layout on -ENOMEM then the check
> could just be moved above the spin_lock(), and the put_layout_hdr removed.
>
> Signed-off-by: Boaz Harrosh <bharrosh@xxxxxxxxxxx>
> ---
> fs/nfs/pnfs.c | 4 +++-
> 1 files changed, 3 insertions(+), 1 deletions(-)
>
> diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
> index a07b007..c3ec577 100644
> --- a/fs/nfs/pnfs.c
> +++ b/fs/nfs/pnfs.c
> @@ -628,6 +628,7 @@ _pnfs_return_layout(struct inode *ino)
> struct nfs_inode *nfsi = NFS_I(ino);
> LIST_HEAD(tmp_list);
> struct nfs4_layoutreturn *lrp;
> + nfs4_stateid stateid;
> int status = 0;
>
> dprintk("--> %s\n", __func__);
> @@ -642,7 +643,7 @@ _pnfs_return_layout(struct inode *ino)
> kfree(lrp);
> goto out;
Rrrr the lrp is leaked here
> }
> - lrp->args.stateid = nfsi->layout->plh_stateid;
> + stateid = nfsi->layout->plh_stateid;
> /* Reference matched in nfs4_layoutreturn_release */
> get_layout_hdr(lo);
> spin_unlock(&ino->i_lock);
> @@ -655,6 +656,7 @@ _pnfs_return_layout(struct inode *ino)
> status = -ENOMEM;
> goto out;
> }
> + lrp->args.stateid = stateid;
> lrp->args.reclaim = 0;
> lrp->args.layout_type = NFS_SERVER(ino)->pnfs_curr_ld->id;
> lrp->args.inode = ino;
I'll send a second squashme. Ignore that one please
Boaz
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
