LU-3032 ptlrpc: race in pinger (use-after-free situation)

[fs/lustre-release.git] / lustre / ptlrpc / pinger.c

diff --git a/lustre/ptlrpc/pinger.c b/lustre/ptlrpc/pinger.c
index b19e96e..06dc234 100644 (file)
--- a/lustre/ptlrpc/pinger.c
+++ b/lustre/ptlrpc/pinger.c
@@ -27,7 +27,7 @@
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  * Use is subject to license terms.
  *
- * Copyright (c) 2011, 2012, Intel Corporation.
+ * Copyright (c) 2011, 2013, Intel Corporation.
  */
 /*
  * This file is part of Lustre, http://www.lustre.org/
@@ -232,6 +232,22 @@ int ptlrpc_check_and_wait_suspend(struct ptlrpc_request *req)
 
 #ifdef __KERNEL__
 
+static bool ir_up;
+
+void ptlrpc_pinger_ir_up(void)
+{
+       CDEBUG(D_HA, "IR up\n");
+       ir_up = true;
+}
+EXPORT_SYMBOL(ptlrpc_pinger_ir_up);
+
+void ptlrpc_pinger_ir_down(void)
+{
+       CDEBUG(D_HA, "IR down\n");
+       ir_up = false;
+}
+EXPORT_SYMBOL(ptlrpc_pinger_ir_down);
+
 static void ptlrpc_pinger_process_import(struct obd_import *imp,
                                          unsigned long this_ping)
 {
@@ -248,8 +264,7 @@ static void ptlrpc_pinger_process_import(struct obd_import *imp,
        /*
         * This will be used below only if the import is "FULL".
         */
-       suppress = !!(imp->imp_connect_data.ocd_connect_flags &
-                     OBD_CONNECT_PINGLESS);
+       suppress = ir_up && OCD_HAS_FLAG(&imp->imp_connect_data, PINGLESS);
 
        imp->imp_force_verify = 0;
 
@@ -363,40 +378,36 @@ static int ptlrpc_pinger_main(void *arg)
         return 0;
 }
 
-static struct ptlrpc_thread *pinger_thread = NULL;
+static struct ptlrpc_thread pinger_thread;
 
 int ptlrpc_start_pinger(void)
 {
-        struct l_wait_info lwi = { 0 };
-        int rc;
+       struct l_wait_info lwi = { 0 };
+       int rc;
 #ifndef ENABLE_PINGER
-        return 0;
+       return 0;
 #endif
-        ENTRY;
+       ENTRY;
 
-        if (pinger_thread != NULL)
-                RETURN(-EALREADY);
+       if (!thread_is_init(&pinger_thread) &&
+           !thread_is_stopped(&pinger_thread))
+               RETURN(-EALREADY);
 
-        OBD_ALLOC_PTR(pinger_thread);
-        if (pinger_thread == NULL)
-                RETURN(-ENOMEM);
-        cfs_waitq_init(&pinger_thread->t_ctl_waitq);
-        cfs_waitq_init(&suspend_timeouts_waitq);
+       cfs_waitq_init(&pinger_thread.t_ctl_waitq);
+       cfs_waitq_init(&suspend_timeouts_waitq);
 
-       strcpy(pinger_thread->t_name, "ll_ping");
+       strcpy(pinger_thread.t_name, "ll_ping");
 
        /* CLONE_VM and CLONE_FILES just avoid a needless copy, because we
         * just drop the VM and FILES in cfs_daemonize_ctxt() right away. */
-        rc = cfs_create_thread(ptlrpc_pinger_main,
-                              pinger_thread, CFS_DAEMON_FLAGS);
-        if (rc < 0) {
-                CERROR("cannot start thread: %d\n", rc);
-                OBD_FREE(pinger_thread, sizeof(*pinger_thread));
-                pinger_thread = NULL;
-                RETURN(rc);
-        }
-        l_wait_event(pinger_thread->t_ctl_waitq,
-                     thread_is_running(pinger_thread), &lwi);
+       rc = cfs_create_thread(ptlrpc_pinger_main,
+                              &pinger_thread, CFS_DAEMON_FLAGS);
+       if (rc < 0) {
+               CERROR("cannot start thread: %d\n", rc);
+               RETURN(rc);
+       }
+       l_wait_event(pinger_thread.t_ctl_waitq,
+                    thread_is_running(&pinger_thread), &lwi);
 
        if (suppress_pings)
                CWARN("Pings will be suppressed at the request of the "
@@ -412,28 +423,24 @@ int ptlrpc_pinger_remove_timeouts(void);
 
 int ptlrpc_stop_pinger(void)
 {
-        struct l_wait_info lwi = { 0 };
-        int rc = 0;
+       struct l_wait_info lwi = { 0 };
 #ifndef ENABLE_PINGER
-        return 0;
+       return 0;
 #endif
-        ENTRY;
+       ENTRY;
 
-        if (pinger_thread == NULL)
-                RETURN(-EALREADY);
+       if (thread_is_init(&pinger_thread) ||
+           thread_is_stopped(&pinger_thread))
+               RETURN(-EALREADY);
 
-        ptlrpc_pinger_remove_timeouts();
-       mutex_lock(&pinger_mutex);
-        thread_set_flags(pinger_thread, SVC_STOPPING);
-        cfs_waitq_signal(&pinger_thread->t_ctl_waitq);
-       mutex_unlock(&pinger_mutex);
+       ptlrpc_pinger_remove_timeouts();
 
-        l_wait_event(pinger_thread->t_ctl_waitq,
-                     thread_is_stopped(pinger_thread), &lwi);
+       thread_set_flags(&pinger_thread, SVC_STOPPING);
+       cfs_waitq_signal(&pinger_thread.t_ctl_waitq);
 
-        OBD_FREE_PTR(pinger_thread);
-        pinger_thread = NULL;
-        RETURN(rc);
+       l_wait_event(pinger_thread.t_ctl_waitq,
+                    thread_is_stopped(&pinger_thread), &lwi);
+       RETURN(0);
 }
 
 void ptlrpc_pinger_sending_on_import(struct obd_import *imp)
@@ -453,7 +460,7 @@ void ptlrpc_pinger_commit_expected(struct obd_import *imp)
         * imp_peer_committed_transno.
         */
        if (imp->imp_state != LUSTRE_IMP_FULL ||
-           imp->imp_connect_data.ocd_connect_flags & OBD_CONNECT_PINGLESS)
+           OCD_HAS_FLAG(&imp->imp_connect_data, PINGLESS))
                imp->imp_force_next_verify = 1;
 }
 
@@ -618,8 +625,8 @@ int ptlrpc_pinger_remove_timeouts(void)
 void ptlrpc_pinger_wake_up()
 {
 #ifdef ENABLE_PINGER
-        thread_add_flags(pinger_thread, SVC_EVENT);
-        cfs_waitq_signal(&pinger_thread->t_ctl_waitq);
+       thread_add_flags(&pinger_thread, SVC_EVENT);
+       cfs_waitq_signal(&pinger_thread.t_ctl_waitq);
 #endif
 }