pNFS: Fix use after free issues in pnfs_do_read()

The assumption should be that if the caller returns PNFS_ATTEMPTED, then hdr
has been consumed, and so we should not be testing hdr->task.tk_status.
If the caller returns PNFS_TRY_AGAIN, then we need to recoalesce and
free hdr.

Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>

diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 634adb3f85243f95d9509a87fa8cf58fb1f6b9b4..eff266ea813c67d5d0b52cc9ff2a77d7c2902a91 100644 (file)
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -2419,10 +2419,20 @@ pnfs_do_read(struct nfs_pageio_descriptor *desc, struct nfs_pgio_header *hdr)
        enum pnfs_try_status trypnfs;
 
        trypnfs = pnfs_try_to_read_data(hdr, call_ops, lseg);
-       if (trypnfs == PNFS_TRY_AGAIN)
-               pnfs_read_resend_pnfs(hdr);
-       if (trypnfs == PNFS_NOT_ATTEMPTED || hdr->task.tk_status)
+       switch (trypnfs) {
+       case PNFS_NOT_ATTEMPTED:
                pnfs_read_through_mds(desc, hdr);
+       case PNFS_ATTEMPTED:
+               break;
+       case PNFS_TRY_AGAIN:
+               /* cleanup hdr and prepare to redo pnfs */
+               if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags)) {
+                       struct nfs_pgio_mirror *mirror = nfs_pgio_current_mirror(desc);
+                       list_splice_init(&hdr->pages, &mirror->pg_list);
+                       mirror->pg_recoalesce = 1;
+               }
+               hdr->mds_ops->rpc_release(hdr);
+       }
 }
 
 static void pnfs_readhdr_free(struct nfs_pgio_header *hdr)