LU-3333 ptlrpc: Protect request buffer changing

[fs/lustre-release.git] / lustre / ptlrpc / sec_plain.c

diff --git a/lustre/ptlrpc/sec_plain.c b/lustre/ptlrpc/sec_plain.c
index bf02263..6adce85 100644 (file)
--- a/lustre/ptlrpc/sec_plain.c
+++ b/lustre/ptlrpc/sec_plain.c
@@ -705,6 +705,15 @@ int plain_enlarge_reqbuf(struct ptlrpc_sec *sec,
                 if (newbuf == NULL)
                         RETURN(-ENOMEM);
 
+               /* Must lock this, so that otherwise unprotected change of
+                * rq_reqmsg is not racing with parallel processing of
+                * imp_replay_list traversing threads. See LU-3333
+                * This is a bandaid at best, we really need to deal with this
+                * in request enlarging code before unpacking that's already
+                * there */
+               if (req->rq_import)
+                       spin_lock(&req->rq_import->imp_lock);
+
                 memcpy(newbuf, req->rq_reqbuf, req->rq_reqbuf_len);
 
                 OBD_FREE_LARGE(req->rq_reqbuf, req->rq_reqbuf_len);
@@ -712,6 +721,9 @@ int plain_enlarge_reqbuf(struct ptlrpc_sec *sec,
                 req->rq_reqbuf_len = newbuf_size;
                 req->rq_reqmsg = lustre_msg_buf(req->rq_reqbuf,
                                                 PLAIN_PACK_MSG_OFF, 0);
+
+               if (req->rq_import)
+                       spin_unlock(&req->rq_import->imp_lock);
         }
 
         _sptlrpc_enlarge_msg_inplace(req->rq_reqbuf, PLAIN_PACK_MSG_OFF,