From patchwork Tue Sep 25 01:07:16 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: NeilBrown X-Patchwork-Id: 10613207 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 02182157B for ; Tue, 25 Sep 2018 01:13:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0620A2A052 for ; Tue, 25 Sep 2018 01:13:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id EECA72A05D; Tue, 25 Sep 2018 01:13:00 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from pdx1-mailman02.dreamhost.com (pdx1-mailman02.dreamhost.com [64.90.62.194]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 90ECA2A052 for ; Tue, 25 Sep 2018 01:13:00 +0000 (UTC) Received: from pdx1-mailman02.dreamhost.com (localhost [IPv6:::1]) by pdx1-mailman02.dreamhost.com (Postfix) with ESMTP id 1F5214C4355; Mon, 24 Sep 2018 18:13:00 -0700 (PDT) X-Original-To: lustre-devel@lists.lustre.org Delivered-To: lustre-devel-lustre.org@pdx1-mailman02.dreamhost.com Received: from mx1.suse.de (mx2.suse.de [195.135.220.15]) by pdx1-mailman02.dreamhost.com (Postfix) with ESMTP id C31264C4256 for ; Mon, 24 Sep 2018 18:12:58 -0700 (PDT) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id C2B19B032; Tue, 25 Sep 2018 01:12:57 +0000 (UTC) From: NeilBrown To: Oleg Drokin , Doug Oucharek , James Simmons , Andreas Dilger Date: Tue, 25 Sep 2018 11:07:16 +1000 Message-ID: <153783763597.32103.14845230051684461634.stgit@noble> In-Reply-To: <153783752960.32103.8394391715843917125.stgit@noble> References: <153783752960.32103.8394391715843917125.stgit@noble> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Subject: [lustre-devel] [PATCH 29/34] LU-7734 lnet: double free in lnet_add_net_common() X-BeenThere: lustre-devel@lists.lustre.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "For discussing Lustre software development." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Lustre Development List Errors-To: lustre-devel-bounces@lists.lustre.org Sender: "lustre-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Olaf Weber lnet_startup_lndnet() always consumes its net parameter, so we should not free net after the function has been called. This fixes a double free triggered by adding a network twice. Eliminate the netl local variable. Signed-off-by: Olaf Weber Change-Id: I1cfc3494eada4660b792f6a1ebd96b5dc80d9945 Reviewed-on: http://review.whamcloud.com/21446 Reviewed-by: Amir Shehata Tested-by: Amir Shehata Signed-off-by: NeilBrown --- drivers/staging/lustre/lnet/lnet/api-ni.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/drivers/staging/lustre/lnet/lnet/api-ni.c b/drivers/staging/lustre/lnet/lnet/api-ni.c index f57200eab746..ea27d38f78c5 100644 --- a/drivers/staging/lustre/lnet/lnet/api-ni.c +++ b/drivers/staging/lustre/lnet/lnet/api-ni.c @@ -2143,7 +2143,6 @@ lnet_get_ni_config(struct lnet_ioctl_config_ni *cfg_ni, static int lnet_add_net_common(struct lnet_net *net, struct lnet_ioctl_config_lnd_tunables *tun) { - struct lnet_net *netl = NULL; u32 net_id; struct lnet_ping_info *pinfo; struct lnet_handle_md md_handle; @@ -2162,8 +2161,8 @@ static int lnet_add_net_common(struct lnet_net *net, if (rnet) { CERROR("Adding net %s will invalidate routing configuration\n", libcfs_net2str(net->net_id)); - rc = -EUSERS; - goto failed1; + lnet_net_free(net); + return -EUSERS; } /* @@ -2180,8 +2179,11 @@ static int lnet_add_net_common(struct lnet_net *net, rc = lnet_ping_info_setup(&pinfo, &md_handle, net_ni_count + lnet_get_ni_count(), false); - if (rc < 0) - goto failed1; + if (rc < 0) { + lnet_net_free(net); + return rc; + } + if (tun) memcpy(&net->net_tunables, &tun->lt_cmn, sizeof(net->net_tunables)); @@ -2204,17 +2206,16 @@ static int lnet_add_net_common(struct lnet_net *net, goto failed; lnet_net_lock(LNET_LOCK_EX); - netl = lnet_get_net_locked(net_id); + net = lnet_get_net_locked(net_id); lnet_net_unlock(LNET_LOCK_EX); - LASSERT(netl); + LASSERT(net); /* * Start the acceptor thread if this is the first network * being added that requires the thread. */ - if (netl->net_lnd->lnd_accept && - num_acceptor_nets == 0) { + if (net->net_lnd->lnd_accept && num_acceptor_nets == 0) { rc = lnet_acceptor_start(); if (rc < 0) { /* shutdown the net that we just started */ @@ -2225,7 +2226,7 @@ static int lnet_add_net_common(struct lnet_net *net, } lnet_net_lock(LNET_LOCK_EX); - lnet_peer_net_added(netl); + lnet_peer_net_added(net); lnet_net_unlock(LNET_LOCK_EX); lnet_ping_target_update(pinfo, md_handle); @@ -2235,8 +2236,6 @@ static int lnet_add_net_common(struct lnet_net *net, failed: lnet_ping_md_unlink(pinfo, &md_handle); lnet_ping_info_free(pinfo); -failed1: - lnet_net_free(net); return rc; }