1. 03 2月, 2012 6 次提交
    • A
      rbd: fix safety of rbd_put_client() · d23a4b3f
      Alex Elder 提交于
      The rbd_client structure uses a kref to arrange for cleaning up and
      freeing an instance when its last reference is dropped.  The cleanup
      routine is rbd_client_release(), and one of the things it does is
      delete the rbd_client from rbd_client_list.  It acquires node_lock
      to do so, but the way it is done is still not safe.
      
      The problem is that when attempting to reuse an existing rbd_client,
      the structure found might already be in the process of getting
      destroyed and cleaned up.
      
      Here's the scenario, with "CLIENT" representing an existing
      rbd_client that's involved in the race:
      
       Thread on CPU A                | Thread on CPU B
       ---------------                | ---------------
       rbd_put_client(CLIENT)         | rbd_get_client()
         kref_put()                   |   (acquires node_lock)
           kref->refcount becomes 0   |   __rbd_client_find() returns CLIENT
           calls rbd_client_release() |   kref_get(&CLIENT->kref);
                                      |   (releases node_lock)
             (acquires node_lock)     |
             deletes CLIENT from list | ...and starts using CLIENT...
             (releases node_lock)     |
             and frees CLIENT         | <-- but CLIENT gets freed here
      
      Fix this by having rbd_put_client() acquire node_lock.  The result
      could still be improved, but at least it avoids this problem.
      Signed-off-by: NAlex Elder <elder@dreamhost.com>
      Signed-off-by: NSage Weil <sage@newdream.net>
      d23a4b3f
    • A
      rbd: fix a memory leak in rbd_get_client() · 97bb59a0
      Alex Elder 提交于
      If an existing rbd client is found to be suitable for use in
      rbd_get_client(), the rbd_options structure is not being
      freed as it should.  Fix that.
      Signed-off-by: NAlex Elder <elder@dreamhost.com>
      Signed-off-by: NSage Weil <sage@newdream.net>
      97bb59a0
    • A
      ceph: create a new session lock to avoid lock inversion · d8fb02ab
      Alex Elder 提交于
      Lockdep was reporting a possible circular lock dependency in
      dentry_lease_is_valid().  That function needs to sample the
      session's s_cap_gen and and s_cap_ttl fields coherently, but needs
      to do so while holding a dentry lock.  The s_cap_lock field was
      being used to protect the two fields, but that can't be taken while
      holding a lock on a dentry within the session.
      
      In most cases, the s_cap_gen and s_cap_ttl fields only get operated
      on separately.  But in three cases they need to be updated together.
      Implement a new lock to protect the spots updating both fields
      atomically is required.
      Signed-off-by: NAlex Elder <elder@dreamhost.com>
      Reviewed-by: NSage Weil <sage@newdream.net>
      d8fb02ab
    • X
      ceph: fix length validation in parse_reply_info() · 32852a81
      Xi Wang 提交于
      "len" is read from network and thus needs validation.  Otherwise, given
      a bogus "len" value, p+len could be an out-of-bounds pointer, which is
      used in further parsing.
      Signed-off-by: NXi Wang <xi.wang@gmail.com>
      Signed-off-by: NSage Weil <sage@newdream.net>
      32852a81
    • S
      ceph: initialize client debugfs outside of monc->mutex · ab434b60
      Sage Weil 提交于
      Initializing debufs under monc->mutex introduces a lock dependency for
      sb->s_type->i_mutex_key, which (combined with several other dependencies)
      leads to an annoying lockdep warning.  There's no particular reason to do
      the debugfs setup under this lock, so move it out.
      
      It used to be the case that our first monmap could come from the OSD; that
      is no longer the case with recent servers, so we will reliably set up the
      client entry during the initial authentication.
      
      We don't have to worry about racing with debugfs teardown by
      ceph_debugfs_client_cleanup() because ceph_destroy_client() calls
      ceph_msgr_flush() first, which will wait for the message dispatch work
      to complete (and the debugfs init to complete).
      
      Fixes: #1940
      Signed-off-by: NSage Weil <sage@newdream.net>
      ab434b60
    • A
      ceph: change "ceph.layout" xattr to be "ceph.file.layout" · 114fc474
      Alex Elder 提交于
      The virtual extended attribute named "ceph.layout" is meaningful
      only for regular files.  Change its name to be "ceph.file.layout" to
      more directly reflect that in the ceph xattr namespace.  Preserve
      the old "ceph.layout" name for the time being (until we decide it's
      safe to get rid of it entirely).
      
      Add a missing initializer for "readonly" in the terminating entry.
      Signed-off-by: NAlex Elder <elder@dreamhost.com>
      Reviewed-by: NSage Weil <sage@newdream.net>
      114fc474
  2. 05 1月, 2012 7 次提交
  3. 04 1月, 2012 14 次提交
  4. 03 1月, 2012 2 次提交
  5. 02 1月, 2012 1 次提交
  6. 01 1月, 2012 3 次提交
  7. 31 12月, 2011 7 次提交