LU-9971 lnet: use after free in lnet_discover_peer_locked()

[fs/lustre-release.git] / lnet / lnet / peer.c

diff --git a/lnet/lnet/peer.c b/lnet/lnet/peer.c
index 2ae8956..01fcad3 100644 (file)
--- a/lnet/lnet/peer.c
+++ b/lnet/lnet/peer.c
@@ -2162,6 +2162,8 @@ again:
         * zombie if we race with DLC, so we must check for that.
         */
        for (;;) {
+               /* Keep lp alive when the lnet_net_lock is unlocked */
+               lnet_peer_addref_locked(lp);
                prepare_to_wait(&lp->lp_dc_waitq, &wait, TASK_INTERRUPTIBLE);
                if (signal_pending(current))
                        break;
@@ -2174,15 +2176,14 @@ again:
                lnet_peer_queue_for_discovery(lp);
 
                /*
-                * if caller requested a non-blocking operation then
-                * return immediately. Once discovery is complete then the
-                * peer ref will be decremented and any pending messages
-                * that were stopped due to discovery will be transmitted.
+                * If caller requested a non-blocking operation then
+                * return immediately. Once discovery is complete any
+                * pending messages that were stopped due to discovery
+                * will be transmitted.
                 */
                if (!block)
                        break;
 
-               lnet_peer_addref_locked(lp);
                lnet_net_unlock(LNET_LOCK_EX);
                schedule();
                finish_wait(&lp->lp_dc_waitq, &wait);
@@ -2205,11 +2206,13 @@ again:
 
        lnet_net_unlock(LNET_LOCK_EX);
        lnet_net_lock(cpt);
-
+       lnet_peer_decref_locked(lp);
        /*
-        * If the peer has changed after we've discovered the older peer,
-        * then we need to discovery the new peer to make sure the
-        * interface information is up to date
+        * The peer may have changed, so re-check and rediscover if that turns
+        * out to have been the case. The reference count on lp ensured that
+        * even if it was unlinked from lpni the memory could not be recycled.
+        * Thus the check below is sufficient to determine whether the peer
+        * changed. If the peer changed, then lp must not be dereferenced.
         */
        if (lp != lpni->lpni_peer_net->lpn_peer)
                goto again;