[LU-5274] ll_statahead_thread() may leak parent, uses parent after dput

Related — Thu, 14 Jun 2018 21:41:37 +0000

In ll_statahead_thread() if ll_prep_md_op_data() returns an error then the parent dentry will be leaked and the parent thread will hang in do_statahead_enter().

static int ll_statahead_thread(void *arg)
{
        struct dentry            *parent = (struct dentry *)arg;

        ...

        thread->t_pid = current_pid();
        CDEBUG(D_READA, "statahead thread starting: sai %p, parent %.*s\n",
               sai, parent->d_name.len, parent->d_name.name);

        op_data = ll_prep_md_op_data(NULL, dir, dir, NULL, 0, 0,
                                     LUSTRE_OPC_ANY, dir);
        if (IS_ERR(op_data))
                RETURN(PTR_ERR(op_data));

        ...

        spin_lock(&plli->lli_sa_lock);
        if (thread_is_init(thread))
                /* If someone else has changed the thread state
                 * (e.g. already changed to SVC_STOPPING), we can't just
                 * blindly overwrite that setting. */
                thread_set_flags(thread, SVC_RUNNING);
        spin_unlock(&plli->lli_sa_lock);
        wake_up(&thread->t_ctl_waitq);

At the end of the same function parent is passed to CDEBUG() after dput():

        dput(parent);
        CDEBUG(D_READA, "statahead thread stopped: sai %p, parent %.*s\n",
               sai, parent->d_name.len, parent->d_name.name);
        return rc;
}

Whamcloud Community JIRA

[LU-5274] ll_statahead_thread() may leak parent, uses parent after dput