[LU-5177] object leak in mdt_open_by_fid_lock()

• Type: Bug
• Resolution: Fixed
• Priority: Blocker
• Fix Version/s: Lustre 2.6.0
• Affects Version/s: Lustre 2.6.0
• Labels: mdt
• Severity: 3
• Assignee: Mikhail Pershin
• Reporter: John Hammond

Description

In mdt_open_by_fid_lock() parent may be leaked if the second call to mdt_object_find() fails.

int mdt_open_by_fid_lock(struct mdt_thread_info *info, struct ldlm_reply *rep,
                         struct mdt_lock_handle *lhc)
{
        const struct lu_env     *env   = info->mti_env;
        struct mdt_device       *mdt   = info->mti_mdt;
        __u64                    flags = info->mti_spec.sp_cr_flags;
        struct mdt_reint_record *rr    = &info->mti_rr;
        struct md_attr          *ma    = &info->mti_attr;
        struct mdt_object       *parent= NULL;
        struct mdt_object       *o;
        int                      rc;
        __u64                    ibits = 0;
        ENTRY;

        if (md_should_create(flags) && !(flags & MDS_OPEN_HAS_EA)) {
                if (!lu_fid_eq(rr->rr_fid1, rr->rr_fid2)) {
                        parent = mdt_object_find(env, mdt, rr->rr_fid1);
                        if (IS_ERR(parent)) {
                                CDEBUG(D_INODE, "Fail to find parent "DFID
                                       " for anonymous created %ld, try to"
                                       " use server-side parent.\n",
                                       PFID(rr->rr_fid1), PTR_ERR(parent));
                                parent = NULL;
                        }
                }
                if (parent == NULL)
                        ma->ma_need |= MA_PFID;
        }

        o = mdt_object_find(env, mdt, rr->rr_fid2);
        if (IS_ERR(o))
                RETURN(rc = PTR_ERR(o));

Issue Links

• is related to: LU-5178 object leak in mdt_rename_sanity()
• is related to: LU-3544 Writing to new files under NFS export from Lustre will result in ENOENT (SLES11SP2)

Comments

[Jodi Levi (Inactive)]

Patch landed to Master.

[Mikhail Pershin]

http://review.whamcloud.com/10750

[Andreas Dilger]

Mike, any progress on this issue? It is listed as a 2.6.0 blocker.

[John Hammond]

In mdt_md_create() child is passed to mdt_create_pack_capa() after being released.

[John Hammond]

Also in mdt_intent_layout()

static int mdt_intent_layout(enum mdt_it_code opcode,
                             struct mdt_thread_info *info,
                             struct ldlm_lock **lockp,
                             __u64 flags)
{
        ...
        struct mdt_object *obj = NULL;
        ...

        fid = &info->mti_tmp_fid2;
        fid_extract_from_res_name(fid, &(*lockp)->l_resource->lr_name);

        obj = mdt_object_find(info->mti_env, info->mti_mdt, fid);
        if (IS_ERR(obj))
                RETURN(PTR_ERR(obj));

        if (mdt_object_exists(obj) && !mdt_object_remote(obj)) {
                /* get the length of lsm */
                rc = mdt_attr_get_eabuf_size(info, obj);
                if (rc < 0)
                        RETURN(rc); /* <---------------------------------- HERE */

                if (rc > info->mti_mdt->mdt_max_mdsize)
                        info->mti_mdt->mdt_max_mdsize = rc;
        }

        mdt_object_put(info->mti_env, obj);