Uploaded image for project: 'Lustre'
  1. Lustre
  2. LU-5274

ll_statahead_thread() may leak parent, uses parent after dput

XMLWordPrintable

    • 3
    • 14717

      In ll_statahead_thread() if ll_prep_md_op_data() returns an error then the parent dentry will be leaked and the parent thread will hang in do_statahead_enter().

      static int ll_statahead_thread(void *arg)
      {
              struct dentry            *parent = (struct dentry *)arg;
      
              ...
      
              thread->t_pid = current_pid();
              CDEBUG(D_READA, "statahead thread starting: sai %p, parent %.*s\n",
                     sai, parent->d_name.len, parent->d_name.name);
      
              op_data = ll_prep_md_op_data(NULL, dir, dir, NULL, 0, 0,
                                           LUSTRE_OPC_ANY, dir);
              if (IS_ERR(op_data))
                      RETURN(PTR_ERR(op_data));
      
              ...
      
              spin_lock(&plli->lli_sa_lock);
              if (thread_is_init(thread))
                      /* If someone else has changed the thread state
                       * (e.g. already changed to SVC_STOPPING), we can't just
                       * blindly overwrite that setting. */
                      thread_set_flags(thread, SVC_RUNNING);
              spin_unlock(&plli->lli_sa_lock);
              wake_up(&thread->t_ctl_waitq);
      

      At the end of the same function parent is passed to CDEBUG() after dput():

              dput(parent);
              CDEBUG(D_READA, "statahead thread stopped: sai %p, parent %.*s\n",
                     sai, parent->d_name.len, parent->d_name.name);
              return rc;
      }
      

            bobijam Zhenyu Xu
            jhammond John Hammond
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved: