| Message ID | 5165EC73.5000600@inktank.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Reviewed-by: Josh Durgin <josh.durgin@inktank.com> On 04/10/2013 03:49 PM, Alex Elder wrote: > It's possible that the reference to the object request dropped > inside the loop in rbd_img_request_submit() will be the last > one, in which case the content of the object pointer can't be > trusted. > > Use a safe form of the object request list traversal to avoid > problems. > > This resolves: > http://tracker.ceph.com/issues/4705 > > Signed-off-by: Alex Elder <elder@inktank.com> > --- > drivers/block/rbd.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c > index 3c0abe6..7eb1032 100644 > --- a/drivers/block/rbd.c > +++ b/drivers/block/rbd.c > @@ -1652,9 +1652,10 @@ static int rbd_img_request_submit(struct > rbd_img_request *img_request) > struct rbd_device *rbd_dev = img_request->rbd_dev; > struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc; > struct rbd_obj_request *obj_request; > + struct rbd_obj_request *next_obj_request; > > dout("%s: img %p\n", __func__, img_request); > - for_each_obj_request(img_request, obj_request) { > + for_each_obj_request_safe(img_request, obj_request, next_obj_request) { > int ret; > > ret = rbd_obj_request_submit(osdc, obj_request); > -- To unsubscribe from this list: send the line "unsubscribe ceph-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c index 3c0abe6..7eb1032 100644 --- a/drivers/block/rbd.c +++ b/drivers/block/rbd.c @@ -1652,9 +1652,10 @@ static int rbd_img_request_submit(struct rbd_img_request *img_request) struct rbd_device *rbd_dev = img_request->rbd_dev; struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc; struct rbd_obj_request *obj_request; + struct rbd_obj_request *next_obj_request; dout("%s: img %p\n", __func__, img_request); - for_each_obj_request(img_request, obj_request) { + for_each_obj_request_safe(img_request, obj_request, next_obj_request) { int ret;
It's possible that the reference to the object request dropped inside the loop in rbd_img_request_submit() will be the last one, in which case the content of the object pointer can't be trusted. Use a safe form of the object request list traversal to avoid problems. This resolves: http://tracker.ceph.com/issues/4705 Signed-off-by: Alex Elder <elder@inktank.com> --- drivers/block/rbd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) ret = rbd_obj_request_submit(osdc, obj_request);