From patchwork Tue Sep 25 01:07:15 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: NeilBrown X-Patchwork-Id: 10613193 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 63DF2157B for ; Tue, 25 Sep 2018 01:12:17 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6749B2A052 for ; Tue, 25 Sep 2018 01:12:17 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5B8AC2A05D; Tue, 25 Sep 2018 01:12:17 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from pdx1-mailman02.dreamhost.com (pdx1-mailman02.dreamhost.com [64.90.62.194]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 060BD2A052 for ; Tue, 25 Sep 2018 01:12:17 +0000 (UTC) Received: from pdx1-mailman02.dreamhost.com (localhost [IPv6:::1]) by pdx1-mailman02.dreamhost.com (Postfix) with ESMTP id A13C74C4214; Mon, 24 Sep 2018 18:12:16 -0700 (PDT) X-Original-To: lustre-devel@lists.lustre.org Delivered-To: lustre-devel-lustre.org@pdx1-mailman02.dreamhost.com Received: from mx1.suse.de (mx2.suse.de [195.135.220.15]) by pdx1-mailman02.dreamhost.com (Postfix) with ESMTP id 4565A4C421E for ; Mon, 24 Sep 2018 18:12:15 -0700 (PDT) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay1.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id 67E2BB034; Tue, 25 Sep 2018 01:12:14 +0000 (UTC) From: NeilBrown To: Oleg Drokin , Doug Oucharek , James Simmons , Andreas Dilger Date: Tue, 25 Sep 2018 11:07:15 +1000 Message-ID: <153783763572.32103.17043305407995526499.stgit@noble> In-Reply-To: <153783752960.32103.8394391715843917125.stgit@noble> References: <153783752960.32103.8394391715843917125.stgit@noble> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Subject: [lustre-devel] [PATCH 22/34] LU-7734 lnet: fix lnet_peer_table_cleanup_locked() X-BeenThere: lustre-devel@lists.lustre.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "For discussing Lustre software development." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Lustre Development List Errors-To: lustre-devel-bounces@lists.lustre.org Sender: "lustre-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Olaf Weber In lnet_peer_table_cleanup_locked() we delete the entire peer if the lnet_peer_ni for the primary NID of the peer is deleted. If the next lnet_peer_ni in the list belongs to the peer being deleted, then the next pointer kept by list_for_each_entry_safe() ends up pointing at freed memory. Add a list_for_each_entry_from() loop to advance next to a peer_ni that does not belong to the peer being deleted and will therefore remain present in the list. Signed-off-by: Olaf Weber Change-Id: I92bf219dc93a79f7d90035ccfbb38cd251138c04 Reviewed-on: http://review.whamcloud.com/20824 Reviewed-by: Amir Shehata Tested-by: Amir Shehata Signed-off-by: NeilBrown --- drivers/staging/lustre/lnet/lnet/peer.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/drivers/staging/lustre/lnet/lnet/peer.c b/drivers/staging/lustre/lnet/lnet/peer.c index 3555e9bd1db1..11edf3632405 100644 --- a/drivers/staging/lustre/lnet/lnet/peer.c +++ b/drivers/staging/lustre/lnet/lnet/peer.c @@ -331,26 +331,32 @@ lnet_peer_table_cleanup_locked(struct lnet_net *net, struct lnet_peer_table *ptable) { int i; + struct lnet_peer_ni *next; struct lnet_peer_ni *lpni; - struct lnet_peer_ni *tmp; struct lnet_peer *peer; for (i = 0; i < LNET_PEER_HASH_SIZE; i++) { - list_for_each_entry_safe(lpni, tmp, &ptable->pt_hash[i], + list_for_each_entry_safe(lpni, next, &ptable->pt_hash[i], lpni_hashlist) { if (net && net != lpni->lpni_net) continue; - /* - * check if by removing this peer ni we should be - * removing the entire peer. - */ peer = lpni->lpni_peer_net->lpn_peer; - - if (peer->lp_primary_nid == lpni->lpni_nid) - lnet_peer_del_locked(peer); - else + if (peer->lp_primary_nid != lpni->lpni_nid) { lnet_peer_ni_del_locked(lpni); + continue; + } + /* + * Removing the primary NID implies removing + * the entire peer. Advance next beyond any + * peer_ni that belongs to the same peer. + */ + list_for_each_entry_from(next, &ptable->pt_hash[i], + lpni_hashlist) { + if (next->lpni_peer_net->lpn_peer != peer) + break; + } + lnet_peer_del_locked(peer); } } }