From patchwork Mon Jul 22 02:12:18 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Simmons X-Patchwork-Id: 11051405 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id E9D3F1580 for ; Mon, 22 Jul 2019 02:12:47 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D4249284CE for ; Mon, 22 Jul 2019 02:12:47 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C8881284DB; Mon, 22 Jul 2019 02:12:47 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from pdx1-mailman02.dreamhost.com (pdx1-mailman02.dreamhost.com [64.90.62.194]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 771AC28500 for ; Mon, 22 Jul 2019 02:12:47 +0000 (UTC) Received: from pdx1-mailman02.dreamhost.com (localhost [IPv6:::1]) by pdx1-mailman02.dreamhost.com (Postfix) with ESMTP id 0106B21FA86; Sun, 21 Jul 2019 19:12:44 -0700 (PDT) X-Original-To: lustre-devel@lists.lustre.org Delivered-To: lustre-devel-lustre.org@pdx1-mailman02.dreamhost.com Received: from smtp3.ccs.ornl.gov (smtp3.ccs.ornl.gov [160.91.203.39]) by pdx1-mailman02.dreamhost.com (Postfix) with ESMTP id 8160321F819 for ; Sun, 21 Jul 2019 19:12:27 -0700 (PDT) Received: from star.ccs.ornl.gov (star.ccs.ornl.gov [160.91.202.134]) by smtp3.ccs.ornl.gov (Postfix) with ESMTP id A40AB278; Sun, 21 Jul 2019 22:12:24 -0400 (EDT) Received: by star.ccs.ornl.gov (Postfix, from userid 2004) id 9B32D1FB; Sun, 21 Jul 2019 22:12:24 -0400 (EDT) From: James Simmons To: Andreas Dilger , Oleg Drokin , NeilBrown , Shaun Tancheff Date: Sun, 21 Jul 2019 22:12:18 -0400 Message-Id: <1563761542-3708-7-git-send-email-jsimmons@infradead.org> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1563761542-3708-1-git-send-email-jsimmons@infradead.org> References: <1563761542-3708-1-git-send-email-jsimmons@infradead.org> Subject: [lustre-devel] [PATCH 06/10] lnet: socklnd: fix infinite loop in ksocknal_push() X-BeenThere: lustre-devel@lists.lustre.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "For discussing Lustre software development." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Lustre Development List MIME-Version: 1.0 Errors-To: lustre-devel-bounces@lists.lustre.org Sender: "lustre-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: NeilBrown If the list_for_each_entry() loop in ksocknal_push() ever finds a match, then it will increment 'i', and the outer loop will continue. Once peer_off becomes larger than the number of matches in a given chain, 'peer_ni' will be an invalid pointer, and ksocknal_push_peer() will probably crash when called on it. To abort the outer loop properly, we need to test if "i <= peer_off", which indicates that all patching peers have been found. This bug can easily be reproduced by running lctl --net tcp push Signed-off-by: NeilBrown WC-bug-id: https://jira.whamcloud.com/browse/LU-12101 Reviewed-on: https://review.whamcloud.com/34499 Reviewed-by: James Simmons Reviewed-by: Sonia Sharma Reviewed-by: Oleg Drokin Signed-off-by: James Simmons --- net/lnet/klnds/socklnd/socklnd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/lnet/klnds/socklnd/socklnd.c b/net/lnet/klnds/socklnd/socklnd.c index 08feaf7..a422481 100644 --- a/net/lnet/klnds/socklnd/socklnd.c +++ b/net/lnet/klnds/socklnd/socklnd.c @@ -1952,7 +1952,7 @@ static int ksocknal_push(struct lnet_ni *ni, struct lnet_process_id id) } read_unlock(&ksocknal_data.ksnd_global_lock); - if (!i) /* no match */ + if (i <= peer_off) /* no match */ break; rc = 0;