diff options
| author | NeilBrown <neilb@suse.com> | 2019-04-05 11:34:40 +1100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-05-02 09:58:55 +0200 |
| commit | c0309570a5f1c78a282943f70b6a98db577403d2 (patch) | |
| tree | 2bebcd8d1dae52404f7a19a18c9fde5f5d8ca405 /net | |
| parent | b4d4b5e4b83979b8b0888295bda1751b4340747c (diff) | |
| download | linux-rpi3-c0309570a5f1c78a282943f70b6a98db577403d2.tar.gz linux-rpi3-c0309570a5f1c78a282943f70b6a98db577403d2.tar.bz2 linux-rpi3-c0309570a5f1c78a282943f70b6a98db577403d2.zip | |
sunrpc: don't mark uninitialised items as VALID.
commit d58431eacb226222430940134d97bfd72f292fcd upstream.
A recent commit added a call to cache_fresh_locked()
when an expired item was found.
The call sets the CACHE_VALID flag, so it is important
that the item actually is valid.
There are two ways it could be valid:
1/ If ->update has been called to fill in relevant content
2/ if CACHE_NEGATIVE is set, to say that content doesn't exist.
An expired item that is waiting for an update will be neither.
Setting CACHE_VALID will mean that a subsequent call to cache_put()
will be likely to dereference uninitialised pointers.
So we must make sure the item is valid, and we already have code to do
that in try_to_negate_entry(). This takes the hash lock and so cannot
be used directly, so take out the two lines that we need and use them.
Now cache_fresh_locked() is certain to be called only on
a valid item.
Cc: stable@kernel.org # 2.6.35
Fixes: 4ecd55ea0742 ("sunrpc: fix cache_head leak due to queued request")
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sunrpc/cache.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c index b6e8eccf2a52..214440c5b14e 100644 --- a/net/sunrpc/cache.c +++ b/net/sunrpc/cache.c @@ -54,6 +54,7 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail) h->last_refresh = now; } +static inline int cache_is_valid(struct cache_head *h); static void cache_fresh_locked(struct cache_head *head, time_t expiry, struct cache_detail *detail); static void cache_fresh_unlocked(struct cache_head *head, @@ -100,6 +101,8 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail, if (cache_is_expired(detail, tmp)) { hlist_del_init(&tmp->cache_list); detail->entries --; + if (cache_is_valid(tmp) == -EAGAIN) + set_bit(CACHE_NEGATIVE, &tmp->flags); cache_fresh_locked(tmp, 0, detail); freeme = tmp; break; |