| Message ID | 1403716607-13535-8-git-send-email-ilya.dryomov@inktank.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 06/25/2014 12:16 PM, Ilya Dryomov wrote: > Linger requests that have not yet been registered should not be > unregistered by __unregister_linger_request(). This messes up ref > count and leads to use-after-free. This makes sense. The problem can occur when updating the OSD map. An OSD *client* has its list of linger requests, but they are not all necessarily registered as associated with the *OSD*. So the __unregister_linger_request() call in kick_requests() might pass a not-yet-registered linger request. It could also occur if a client (like RBD) gets an error after setting a request to linger but the request has completed successfully. Anyway, looks good. This explains why the rename of the r_linger_osd_item field was helpful. Reviewed-by: Alex Elder <elder@linaro.org> > > Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com> > --- > net/ceph/osd_client.c | 15 +++++++++++++-- > 1 file changed, 13 insertions(+), 2 deletions(-) > > diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c > index a9b7ea7bfdc6..12ec553a7e76 100644 > --- a/net/ceph/osd_client.c > +++ b/net/ceph/osd_client.c > @@ -1248,7 +1248,9 @@ static void __cancel_request(struct ceph_osd_request *req) > static void __register_linger_request(struct ceph_osd_client *osdc, > struct ceph_osd_request *req) > { > - dout("__register_linger_request %p\n", req); > + dout("%s %p tid %llu\n", __func__, req, req->r_tid); > + WARN_ON(!req->r_linger); > + > ceph_osdc_get_request(req); > list_add_tail(&req->r_linger_item, &osdc->req_linger); > if (req->r_osd) > @@ -1259,8 +1261,17 @@ static void __register_linger_request(struct ceph_osd_client *osdc, > static void __unregister_linger_request(struct ceph_osd_client *osdc, > struct ceph_osd_request *req) > { > - dout("__unregister_linger_request %p\n", req); > + WARN_ON(!req->r_linger); > + > + if (list_empty(&req->r_linger_item)) { > + dout("%s %p tid %llu not registered\n", __func__, req, > + req->r_tid); > + return; > + } > + > + dout("%s %p tid %llu\n", __func__, req, req->r_tid); > list_del_init(&req->r_linger_item); > + > if (req->r_osd) { > list_del_init(&req->r_linger_osd_item); > maybe_move_osd_to_lru(osdc, req->r_osd); > -- To unsubscribe from this list: send the line "unsubscribe ceph-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 06/25/2014 12:16 PM, Ilya Dryomov wrote: > Linger requests that have not yet been registered should not be > unregistered by __unregister_linger_request(). This messes up ref > count and leads to use-after-free. > > Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com> > --- > net/ceph/osd_client.c | 15 +++++++++++++-- > 1 file changed, 13 insertions(+), 2 deletions(-) > > diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c > index a9b7ea7bfdc6..12ec553a7e76 100644 > --- a/net/ceph/osd_client.c > +++ b/net/ceph/osd_client.c > @@ -1248,7 +1248,9 @@ static void __cancel_request(struct ceph_osd_request *req) > static void __register_linger_request(struct ceph_osd_client *osdc, > struct ceph_osd_request *req) > { > - dout("__register_linger_request %p\n", req); > + dout("%s %p tid %llu\n", __func__, req, req->r_tid); > + WARN_ON(!req->r_linger); > + > ceph_osdc_get_request(req); > list_add_tail(&req->r_linger_item, &osdc->req_linger); > if (req->r_osd) > @@ -1259,8 +1261,17 @@ static void __register_linger_request(struct ceph_osd_client *osdc, > static void __unregister_linger_request(struct ceph_osd_client *osdc, > struct ceph_osd_request *req) > { > - dout("__unregister_linger_request %p\n", req); > + WARN_ON(!req->r_linger); I just noticed something. ceph_osdc_unregister_linger_request() clears req->r_linger before calling __unregister_linger_request(), which means this warning must be tripping a lot... Just delete that assignment in ceph_osdc_unregister_linger_request() as part of this commit. -Alex > + > + if (list_empty(&req->r_linger_item)) { > + dout("%s %p tid %llu not registered\n", __func__, req, > + req->r_tid); > + return; > + } > + > + dout("%s %p tid %llu\n", __func__, req, req->r_tid); > list_del_init(&req->r_linger_item); > + > if (req->r_osd) { > list_del_init(&req->r_linger_osd_item); > maybe_move_osd_to_lru(osdc, req->r_osd); > -- To unsubscribe from this list: send the line "unsubscribe ceph-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Mon, Jun 30, 2014 at 5:50 PM, Alex Elder <elder@ieee.org> wrote: > On 06/25/2014 12:16 PM, Ilya Dryomov wrote: >> Linger requests that have not yet been registered should not be >> unregistered by __unregister_linger_request(). This messes up ref >> count and leads to use-after-free. >> >> Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com> >> --- >> net/ceph/osd_client.c | 15 +++++++++++++-- >> 1 file changed, 13 insertions(+), 2 deletions(-) >> >> diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c >> index a9b7ea7bfdc6..12ec553a7e76 100644 >> --- a/net/ceph/osd_client.c >> +++ b/net/ceph/osd_client.c >> @@ -1248,7 +1248,9 @@ static void __cancel_request(struct ceph_osd_request *req) >> static void __register_linger_request(struct ceph_osd_client *osdc, >> struct ceph_osd_request *req) >> { >> - dout("__register_linger_request %p\n", req); >> + dout("%s %p tid %llu\n", __func__, req, req->r_tid); >> + WARN_ON(!req->r_linger); >> + >> ceph_osdc_get_request(req); >> list_add_tail(&req->r_linger_item, &osdc->req_linger); >> if (req->r_osd) >> @@ -1259,8 +1261,17 @@ static void __register_linger_request(struct ceph_osd_client *osdc, >> static void __unregister_linger_request(struct ceph_osd_client *osdc, >> struct ceph_osd_request *req) >> { >> - dout("__unregister_linger_request %p\n", req); >> + WARN_ON(!req->r_linger); > > > I just noticed something. ceph_osdc_unregister_linger_request() > clears req->r_linger before calling __unregister_linger_request(), > which means this warning must be tripping a lot... > > Just delete that assignment in ceph_osdc_unregister_linger_request() > as part of this commit. ceph_osdc_unregister_linger_request() is removed entirely later in the series. Thanks, Ilya -- To unsubscribe from this list: send the line "unsubscribe ceph-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c index a9b7ea7bfdc6..12ec553a7e76 100644 --- a/net/ceph/osd_client.c +++ b/net/ceph/osd_client.c @@ -1248,7 +1248,9 @@ static void __cancel_request(struct ceph_osd_request *req) static void __register_linger_request(struct ceph_osd_client *osdc, struct ceph_osd_request *req) { - dout("__register_linger_request %p\n", req); + dout("%s %p tid %llu\n", __func__, req, req->r_tid); + WARN_ON(!req->r_linger); + ceph_osdc_get_request(req); list_add_tail(&req->r_linger_item, &osdc->req_linger); if (req->r_osd) @@ -1259,8 +1261,17 @@ static void __register_linger_request(struct ceph_osd_client *osdc, static void __unregister_linger_request(struct ceph_osd_client *osdc, struct ceph_osd_request *req) { - dout("__unregister_linger_request %p\n", req); + WARN_ON(!req->r_linger); + + if (list_empty(&req->r_linger_item)) { + dout("%s %p tid %llu not registered\n", __func__, req, + req->r_tid); + return; + } + + dout("%s %p tid %llu\n", __func__, req, req->r_tid); list_del_init(&req->r_linger_item); + if (req->r_osd) { list_del_init(&req->r_linger_osd_item); maybe_move_osd_to_lru(osdc, req->r_osd);
Linger requests that have not yet been registered should not be unregistered by __unregister_linger_request(). This messes up ref count and leads to use-after-free. Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com> --- net/ceph/osd_client.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)