Commit d58431ea authored by NeilBrown's avatar NeilBrown Committed by J. Bruce Fields

sunrpc: don't mark uninitialised items as VALID.

A recent commit added a call to cache_fresh_locked()
when an expired item was found.
The call sets the CACHE_VALID flag, so it is important
that the item actually is valid.
There are two ways it could be valid:
1/ If ->update has been called to fill in relevant content
2/ if CACHE_NEGATIVE is set, to say that content doesn't exist.

An expired item that is waiting for an update will be neither.
Setting CACHE_VALID will mean that a subsequent call to cache_put()
will be likely to dereference uninitialised pointers.

So we must make sure the item is valid, and we already have code to do
that in try_to_negate_entry().  This takes the hash lock and so cannot
be used directly, so take out the two lines that we need and use them.

Now cache_fresh_locked() is certain to be called only on
a valid item.

Cc: stable@kernel.org # 2.6.35
Fixes: 4ecd55ea ("sunrpc: fix cache_head leak due to queued request")
Signed-off-by: default avatarNeilBrown <neilb@suse.com>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
parent 79a3aaa7
...@@ -54,6 +54,7 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail) ...@@ -54,6 +54,7 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail)
h->last_refresh = now; h->last_refresh = now;
} }
static inline int cache_is_valid(struct cache_head *h);
static void cache_fresh_locked(struct cache_head *head, time_t expiry, static void cache_fresh_locked(struct cache_head *head, time_t expiry,
struct cache_detail *detail); struct cache_detail *detail);
static void cache_fresh_unlocked(struct cache_head *head, static void cache_fresh_unlocked(struct cache_head *head,
...@@ -105,6 +106,8 @@ static struct cache_head *sunrpc_cache_add_entry(struct cache_detail *detail, ...@@ -105,6 +106,8 @@ static struct cache_head *sunrpc_cache_add_entry(struct cache_detail *detail,
if (cache_is_expired(detail, tmp)) { if (cache_is_expired(detail, tmp)) {
hlist_del_init_rcu(&tmp->cache_list); hlist_del_init_rcu(&tmp->cache_list);
detail->entries --; detail->entries --;
if (cache_is_valid(tmp) == -EAGAIN)
set_bit(CACHE_NEGATIVE, &tmp->flags);
cache_fresh_locked(tmp, 0, detail); cache_fresh_locked(tmp, 0, detail);
freeme = tmp; freeme = tmp;
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment