[LU-5324] lfsck: possible issue in lfsck_del_target()

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.6.0
• Affects Version/s: Lustre 2.6.0
• Severity: 3
• Assignee: nasf (Inactive)
• Reporter: Frank Zago (Inactive)

Description

lfsck_del_target() has the following code around line 2648:

   2648     list_for_each_entry(ltd, head, ltd_orphan_list) {
   2649         if (ltd->ltd_tgt == tgt) {
   2650             list_del_init(&ltd->ltd_orphan_list);
   2651             spin_unlock(&lfsck_instance_lock);
   2652             lfsck_tgt_put(ltd);
   2653 
   2654             return;
   2655         }
   2656     }

If the target is not found, the code continues. Note that at that point, the loop cursor ltd is undefined but not NULL.

A few lines later, we have

   2671     if (unlikely(index >= ltds->ltd_tgts_bitmap->size))
   2672         goto unlock;

If that path is taken, we do:

   2685     if (ltd == NULL) {
...
   2697     }
   2698 
   2699     up_write(&ltds->ltd_rw_sem);
   2700     if (ltd != NULL) {
...

But ltd is undefined. So bad things will happen (likely an oops or a memory corruption).

I think the fix is to either set ltd to NULL, or have a second exit point.

I don't have a patch for that.