ceph: avoid null deref in osd request error path
authorSage Weil <sage@newdream.net>
Mon, 27 Sep 2010 17:18:52 +0000 (10:18 -0700)
committerSage Weil <sage@newdream.net>
Thu, 7 Oct 2010 15:00:23 +0000 (08:00 -0700)
If we interrupt an osd request, we call __cancel_request, but it wasn't
verifying that req->r_osd was non-NULL before dereferencing it.  This could
cause a crash if osds were flapping and we aborted a request on said osd.

Reported-by: Henry C Chang <henry_c_chang@tcloudcomputing.com>
Signed-off-by: Sage Weil <sage@newdream.net>
fs/ceph/osd_client.c

index dfced1dacbcdcb47178f2c9676275869c2105296..3b5571b8ce22e2ef8abdcf3d2dd4da1598bf6233 100644 (file)
@@ -549,7 +549,7 @@ static void __unregister_request(struct ceph_osd_client *osdc,
  */
 static void __cancel_request(struct ceph_osd_request *req)
 {
-       if (req->r_sent) {
+       if (req->r_sent && req->r_osd) {
                ceph_con_revoke(&req->r_osd->o_con, req->r_request);
                req->r_sent = 0;
        }