Commit 66f38bf9 authored by Nikolay Borisov's avatar Nikolay Borisov Committed by Sasha Levin

ceph: fix error handling in ceph_read_iter

[ Upstream commit 0d7718f6 ]

In case __ceph_do_getattr returns an error and the retry_op in
ceph_read_iter is not READ_INLINE, then it's possible to invoke
__free_page on a page which is NULL, this naturally leads to a crash.
This can happen when, for example, a process waiting on a MDS reply
receives sigterm.

Fix this by explicitly checking whether the page is set or not.

Cc: stable@vger.kernel.org # 3.19+
Signed-off-by: default avatarNikolay Borisov <kernel@kyup.com>
Reviewed-by: default avatarYan, Zheng <zyan@redhat.com>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
parent 9e9ca450
...@@ -868,7 +868,8 @@ static ssize_t ceph_read_iter(struct kiocb *iocb, struct iov_iter *to) ...@@ -868,7 +868,8 @@ static ssize_t ceph_read_iter(struct kiocb *iocb, struct iov_iter *to)
statret = __ceph_do_getattr(inode, page, statret = __ceph_do_getattr(inode, page,
CEPH_STAT_CAP_INLINE_DATA, !!page); CEPH_STAT_CAP_INLINE_DATA, !!page);
if (statret < 0) { if (statret < 0) {
__free_page(page); if (page)
__free_page(page);
if (statret == -ENODATA) { if (statret == -ENODATA) {
BUG_ON(retry_op != READ_INLINE); BUG_ON(retry_op != READ_INLINE);
goto again; goto again;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment