ceph: fix NULL pointer dereference for req->r_session

[ Upstream commit 5bd76b8de5b74fa941a6eafee87728a0fe072267 ]

The request's r_session maybe changed when it was forwarded or
resent. Both the forwarding and resending cases the requests will
be protected by the mdsc->mutex.

Cc: stable@vger.kernel.org
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2137955
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 668be87ffee6da6b29c60af3b5e2da16e492198f..51562d36fa83dde0905178a7cc3465dda4425dea 100644 (file)
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -2297,7 +2297,6 @@ static int unsafe_request_wait(struct inode *inode)
        struct ceph_mds_client *mdsc = ceph_sb_to_client(inode->i_sb)->mdsc;
        struct ceph_inode_info *ci = ceph_inode(inode);
        struct ceph_mds_request *req1 = NULL, *req2 = NULL;
-       unsigned int max_sessions;
        int ret, err = 0;
 
        spin_lock(&ci->i_unsafe_lock);
@@ -2315,28 +2314,24 @@ static int unsafe_request_wait(struct inode *inode)
        }
        spin_unlock(&ci->i_unsafe_lock);
 
-       /*
-        * The mdsc->max_sessions is unlikely to be changed
-        * mostly, here we will retry it by reallocating the
-        * sessions array memory to get rid of the mdsc->mutex
-        * lock.
-        */
-retry:
-       max_sessions = mdsc->max_sessions;
-
        /*
         * Trigger to flush the journal logs in all the relevant MDSes
         * manually, or in the worst case we must wait at most 5 seconds
         * to wait the journal logs to be flushed by the MDSes periodically.
         */
-       if ((req1 || req2) && likely(max_sessions)) {
-               struct ceph_mds_session **sessions = NULL;
-               struct ceph_mds_session *s;
+       if (req1 || req2) {
                struct ceph_mds_request *req;
+               struct ceph_mds_session **sessions;
+               struct ceph_mds_session *s;
+               unsigned int max_sessions;
                int i;
 
+               mutex_lock(&mdsc->mutex);
+               max_sessions = mdsc->max_sessions;
+
                sessions = kcalloc(max_sessions, sizeof(s), GFP_KERNEL);
                if (!sessions) {
+                       mutex_unlock(&mdsc->mutex);
                        err = -ENOMEM;
                        goto out;
                }
@@ -2348,16 +2343,6 @@ static int unsafe_request_wait(struct inode *inode)
                                s = req->r_session;
                                if (!s)
                                        continue;
-                               if (unlikely(s->s_mds >= max_sessions)) {
-                                       spin_unlock(&ci->i_unsafe_lock);
-                                       for (i = 0; i < max_sessions; i++) {
-                                               s = sessions[i];
-                                               if (s)
-                                                       ceph_put_mds_session(s);
-                                       }
-                                       kfree(sessions);
-                                       goto retry;
-                               }
                                if (!sessions[s->s_mds]) {
                                        s = ceph_get_mds_session(s);
                                        sessions[s->s_mds] = s;
@@ -2370,16 +2355,6 @@ static int unsafe_request_wait(struct inode *inode)
                                s = req->r_session;
                                if (!s)
                                        continue;
-                               if (unlikely(s->s_mds >= max_sessions)) {
-                                       spin_unlock(&ci->i_unsafe_lock);
-                                       for (i = 0; i < max_sessions; i++) {
-                                               s = sessions[i];
-                                               if (s)
-                                                       ceph_put_mds_session(s);
-                                       }
-                                       kfree(sessions);
-                                       goto retry;
-                               }
                                if (!sessions[s->s_mds]) {
                                        s = ceph_get_mds_session(s);
                                        sessions[s->s_mds] = s;
@@ -2391,11 +2366,12 @@ static int unsafe_request_wait(struct inode *inode)
                /* the auth MDS */
                spin_lock(&ci->i_ceph_lock);
                if (ci->i_auth_cap) {
-                     s = ci->i_auth_cap->session;
-                     if (!sessions[s->s_mds])
-                             sessions[s->s_mds] = ceph_get_mds_session(s);
+                       s = ci->i_auth_cap->session;
+                       if (!sessions[s->s_mds])
+                               sessions[s->s_mds] = ceph_get_mds_session(s);
                }
                spin_unlock(&ci->i_ceph_lock);
+               mutex_unlock(&mdsc->mutex);
 
                /* send flush mdlog request to MDSes */
                for (i = 0; i < max_sessions; i++) {