From 13c8d5e4bebf437227d95582c36ec1567b150cac Mon Sep 17 00:00:00 2001 From: Andriy Skulysh Date: Thu, 22 Jun 2017 11:08:45 +0300 Subject: [PATCH] LU-6436 llite: NULL pointer dereference in cl_object_top() During race condition iget5_locked() returns inode without I_NEW bit for the second thread. If cl_file_inode_init() failed for the first thread lli_clob isn't valid for corresponding fid. But failed inode is marked bad, check it. Change-Id: I02e477486e51d2653c8b047a18c54a5528b440c5 Seagate-bug-id: MRP-4035 Signed-off-by: Andriy Skulysh Reviewed-on: https://review.whamcloud.com/27777 Tested-by: Jenkins Reviewed-by: Bobi Jam Tested-by: Maloo Reviewed-by: Jinshan Xiong Reviewed-by: Oleg Drokin --- lustre/llite/namei.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lustre/llite/namei.c b/lustre/llite/namei.c index f53818a..de168ab 100644 --- a/lustre/llite/namei.c +++ b/lustre/llite/namei.c @@ -139,6 +139,9 @@ struct inode *ll_iget(struct super_block *sb, ino_t hash, inode_has_no_xattr(inode); unlock_new_inode(inode); } + } else if (is_bad_inode(inode)) { + iput(inode); + inode = ERR_PTR(-ESTALE); } else if (!(inode->i_state & (I_FREEING | I_CLEAR))) { rc = ll_update_inode(inode, md); CDEBUG(D_VFSTRACE, "got inode: "DFID"(%p): rc = %d\n", -- 1.8.3.1