From: Sage Weil <sage@newdream.net>
Date: Tue, 29 Mar 2011 19:11:06 +0000 (-0700)
Subject: libceph: fix null dereference when unregistering linger requests
X-Git-Tag: v2.6.39-rc2~36^2~3
X-Git-Url: https://openfabrics.org/gitweb/?a=commitdiff_plain;h=fbdb9190482fd83a3eb20cdeb0da454759f479d7;p=~shefty%2Frdma-dev.git

libceph: fix null dereference when unregistering linger requests

We should only clear r_osd if we are neither registered as a linger or a
regular request.  We may unregister as a linger while still registered as
a regular request (e.g., in reset_osd).  Incorrectly clearing r_osd there
leads to a null pointer dereference in __send_request.

Also simplify the parallel check in __unregister_request() where we just
removed r_osd_item and know it's empty.

Signed-off-by: Sage Weil <sage@newdream.net>
---

diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 03740e8fc9d..3b91d651fe0 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -837,8 +837,7 @@ static void __unregister_request(struct ceph_osd_client *osdc,
 			dout("moving osd to %p lru\n", req->r_osd);
 			__move_osd_to_lru(osdc, req->r_osd);
 		}
-		if (list_empty(&req->r_osd_item) &&
-		    list_empty(&req->r_linger_item))
+		if (list_empty(&req->r_linger_item))
 			req->r_osd = NULL;
 	}
 
@@ -883,7 +882,8 @@ static void __unregister_linger_request(struct ceph_osd_client *osdc,
 			dout("moving osd to %p lru\n", req->r_osd);
 			__move_osd_to_lru(osdc, req->r_osd);
 		}
-		req->r_osd = NULL;
+		if (list_empty(&req->r_osd_item))
+			req->r_osd = NULL;
 	}
 }