diff options
| author | Ilya Dryomov <idryomov@gmail.com> | 2017-06-15 17:30:55 +0300 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2017-07-07 18:25:16 +0300 |
| commit | a10bcb19ae02cea7d5e6650fbc2de3ced46b4e5d (patch) | |
| tree | 5d1d14ada42bce2e2d6cc68bb137a267b0d6353d | |
| parent | 7de030d6b10a56e991312a978ace6be3c090097c (diff) | |
| download | linux-a10bcb19ae02cea7d5e6650fbc2de3ced46b4e5d.tar.xz | |
libceph: delete from need_resend_linger before check_linger_pool_dne()
When processing a map update consisting of multiple incrementals, we
may end up running check_linger_pool_dne() on a lingering request that
was previously added to need_resend_linger list. If it is concluded
that the target pool doesn't exist, the request is killed off while
still on need_resend_linger list, which leads to a crash on a NULL
lreq->osd in kick_requests():
libceph: linger_id 18446462598732840961 pool does not exist
BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
IP: ceph_osdc_handle_map+0x4ae/0x870
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
| -rw-r--r-- | net/ceph/osd_client.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c index 518dbac599d0..576101b635ef 100644 --- a/net/ceph/osd_client.c +++ b/net/ceph/osd_client.c @@ -3243,6 +3243,7 @@ static void scan_requests(struct ceph_osd *osd, list_add_tail(&lreq->scan_item, need_resend_linger); break; case CALC_TARGET_POOL_DNE: + list_del_init(&lreq->scan_item); check_linger_pool_dne(lreq); break; } |