diff options
| author | Alex Elder <elder@inktank.com> | 2013-04-10 17:47:46 -0500 |
|---|---|---|
| committer | Sage Weil <sage@inktank.com> | 2013-04-17 11:39:09 -0700 |
| commit | 46faeed4a61e220b99591e9773057160eb437cc8 (patch) | |
| tree | cba50f0421c71726396cf1d527570046ba117cc6 /drivers/block | |
| parent | 6e2a4505dba0cae8faa701426185dfb7b49f537c (diff) | |
rbd: do a safe list traversal in rbd_img_request_submit()
It's possible that the reference to the object request dropped
inside the loop in rbd_img_request_submit() will be the last
one, in which case the content of the object pointer can't be
trusted.
Use a safe form of the object request list traversal to avoid
problems.
This resolves:
http://tracker.ceph.com/issues/4705
Signed-off-by: Alex Elder <elder@inktank.com>
Reviewed-by: Josh Durgin <josh.durgin@inktank.com>
Diffstat (limited to 'drivers/block')
| -rw-r--r-- | drivers/block/rbd.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c index f556f8a8b3f9..b7b7a88d9f68 100644 --- a/drivers/block/rbd.c +++ b/drivers/block/rbd.c @@ -1742,9 +1742,10 @@ static int rbd_img_request_submit(struct rbd_img_request *img_request) struct rbd_device *rbd_dev = img_request->rbd_dev; struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc; struct rbd_obj_request *obj_request; + struct rbd_obj_request *next_obj_request; dout("%s: img %p\n", __func__, img_request); - for_each_obj_request(img_request, obj_request) { + for_each_obj_request_safe(img_request, obj_request, next_obj_request) { int ret; obj_request->callback = rbd_img_obj_callback; |