[LU-4462] ERR_PTR dereferences in mdt_reconstruct functions

• Status: Resolved
• Project: Lustre
• Affects Version/s: Lustre 2.6.0
• Fix Version/s: Lustre 2.6.0, Lustre 2.5.3
• Type: Bug
• Priority: Minor
• Reporter: John Hammond
• Assignee: John Hammond
• Resolution: Fixed
• Labels: mdt
• Severity: 3

Description

In some mdt_reconstruct functions we are dereferencing ERR_PTRs. In each case it's mdt_object_fid(child) after IS_ERR(child) has returned true.

HANDLING: lustre/mdt/mdt_open.c
diff =
diff -u -p a/mdt/mdt_open.c b/mdt/mdt_open.c
--- a/mdt/mdt_open.c
+++ b/mdt/mdt_open.c
@@ -1091,7 +1091,7 @@ void mdt_reconstruct_open(struct mdt_thr
                         rc = PTR_ERR(child);
                         LCONSOLE_WARN("Child "DFID" lookup error %d."
                                       " Evicting client %s with export %s.\n",
-                                      PFID(mdt_object_fid(child)), rc,
+                                      PFID(), rc,
                                       obd_uuid2str(&exp->exp_client_uuid),
                                       obd_export_nid2str(exp));
                         mdt_object_put(env, parent);


diff -u -p a/mdt/mdt_recovery.c b/mdt/mdt_recovery.c
--- a/mdt/mdt_recovery.c
+++ b/mdt/mdt_recovery.c
@@ -255,7 +255,7 @@ static void mdt_reconstruct_create(struc
                 rc = PTR_ERR(child);
                 LCONSOLE_WARN("Child "DFID" lookup error %d."
                               " Evicting client %s with export %s.\n",
-                              PFID(mdt_object_fid(child)), rc,
+                              PFID(), rc,
                               obd_uuid2str(&exp->exp_client_uuid),
                               obd_export_nid2str(exp));
                 mdt_export_evict(exp);
@@ -301,7 +301,7 @@ static void mdt_reconstruct_setattr(stru
                 int rc = PTR_ERR(obj);
                 LCONSOLE_WARN(""DFID" lookup error %d."
                               " Evicting client %s with export %s.\n",
-                              PFID(mdt_object_fid(obj)), rc,
+                              PFID(), rc,
                               obd_uuid2str(&exp->exp_client_uuid),
                               obd_export_nid2str(exp));
                 mdt_export_evict(exp);

This was found using the coccinelle script:

// this detects cases where a value compared to NULL is subsequently passed
// to PTR_ERR
//
// Confidence: High
// Copyright: (C) Gilles Muller, Julia Lawall, EMN, INRIA, DIKU.  GPLv2.
// URL: http://coccinelle.lip6.fr/rules/ptr.html
// Options:

@@

identifier F !~ "^\(RETURN\|GOTO\|PTR_ERR\|ERR_CAST\)$";
expression E,E1;
@@

if (IS_ERR(E)) {
        <+... when != E = E1
-       F(...,E,...)
        ...+>
}

Comments

[John Hammond]

Please see http://review.whamcloud.com/8788.

[John Hammond]

Patch landed to master.