Commit 46faeed4 authored by Alex Elder's avatar Alex Elder Committed by Sage Weil

rbd: do a safe list traversal in rbd_img_request_submit()

It's possible that the reference to the object request dropped
inside the loop in rbd_img_request_submit() will be the last
one, in which case the content of the object pointer can't be
trusted.

Use a safe form of the object request list traversal to avoid
problems.

This resolves:
    http://tracker.ceph.com/issues/4705Signed-off-by: default avatarAlex Elder <elder@inktank.com>
Reviewed-by: default avatarJosh Durgin <josh.durgin@inktank.com>
parent 6e2a4505
...@@ -1742,9 +1742,10 @@ static int rbd_img_request_submit(struct rbd_img_request *img_request) ...@@ -1742,9 +1742,10 @@ static int rbd_img_request_submit(struct rbd_img_request *img_request)
struct rbd_device *rbd_dev = img_request->rbd_dev; struct rbd_device *rbd_dev = img_request->rbd_dev;
struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc; struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
struct rbd_obj_request *obj_request; struct rbd_obj_request *obj_request;
struct rbd_obj_request *next_obj_request;
dout("%s: img %p\n", __func__, img_request); dout("%s: img %p\n", __func__, img_request);
for_each_obj_request(img_request, obj_request) { for_each_obj_request_safe(img_request, obj_request, next_obj_request) {
int ret; int ret;
obj_request->callback = rbd_img_obj_callback; obj_request->callback = rbd_img_obj_callback;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment