[LU-5274] ll_statahead_thread() may leak parent, uses parent after dput

• Type: Bug
• Resolution: Fixed
• Priority: Major
• Fix Version/s: Lustre 2.7.0
• Affects Version/s: Lustre 2.6.0
• Labels: malloc patch statahead
• Severity: 3
• Assignee: Zhenyu Xu
• Reporter: John Hammond

Description

In ll_statahead_thread() if ll_prep_md_op_data() returns an error then the parent dentry will be leaked and the parent thread will hang in do_statahead_enter().

static int ll_statahead_thread(void *arg)
{
        struct dentry            *parent = (struct dentry *)arg;

        ...

        thread->t_pid = current_pid();
        CDEBUG(D_READA, "statahead thread starting: sai %p, parent %.*s\n",
               sai, parent->d_name.len, parent->d_name.name);

        op_data = ll_prep_md_op_data(NULL, dir, dir, NULL, 0, 0,
                                     LUSTRE_OPC_ANY, dir);
        if (IS_ERR(op_data))
                RETURN(PTR_ERR(op_data));

        ...

        spin_lock(&plli->lli_sa_lock);
        if (thread_is_init(thread))
                /* If someone else has changed the thread state
                 * (e.g. already changed to SVC_STOPPING), we can't just
                 * blindly overwrite that setting. */
                thread_set_flags(thread, SVC_RUNNING);
        spin_unlock(&plli->lli_sa_lock);
        wake_up(&thread->t_ctl_waitq);

At the end of the same function parent is passed to CDEBUG() after dput():

        dput(parent);
        CDEBUG(D_READA, "statahead thread stopped: sai %p, parent %.*s\n",
               sai, parent->d_name.len, parent->d_name.name);
        return rc;
}

Issue Links

• is related to: LU-5071 statahead.c:1704:do_statahead_enter()) ASSERTION( lli->u.d.d_sai == ((void *)0) ) failed: