[LU-3807] unsafe error handing around ll_splice_alias()

Fri, 6 Sep 2013 16:41:18 +0000

Under memory pressure, ll_d_init() may fail to allocate a ll_dentry_data for the passed in dentry. When this happens ll_splice_alias() will return ERR_PTR(-ENOMEM). In ll_lookup_it() via ll_statahead_enter() and ll_lookup_it_finish() (which both call ll_splice_alias()) this err pointer will be assigned to both retval and dentry. Then on the way out this invalid dentry will be passed to ll_statahead_mark() thereby causing an oops.

ll_lookup_it(parent, dentry, ...)
        ll_statahead_enter(parent, &dentry, 0)
                do_statahead_enter(parent, &dentry, 0)
                        dentry = ll_splice_alias(parent, dentry)
                                ll_d_init(dentry)
        ll_lookup_it_finish(parent, &dentry,...)
                        dentry = ll_splice_alias(parent, dentry)
                                ll_d_init(dentry)

A similar situation may exist in ll_revalidate_nd().

Whamcloud Community JIRA

[LU-3807] unsafe error handing around ll_splice_alias()