From 62e3367f94774fd10ab8df307a6eae4da4491554 Mon Sep 17 00:00:00 2001 From: Oleg Drokin Date: Fri, 27 Dec 2013 22:31:15 -0500 Subject: [PATCH] LU-4360 Fix use after free in ksocknal_send Call to ksocknal_launch_packet might schedule a callback that might free the just sent message, and so subsequent access to it via lntmsg->msg_vmflush goes to freed memory. Instead we'll just remember if we are in the vmflush thread and only restore if we happened to set mempressure flag. Change-Id: I2f0f8b27e26e11b37ad60fde4c98e86c39768349 Signed-off-by: Oleg Drokin Reviewed-on: http://review.whamcloud.com/8667 Tested-by: Jenkins Tested-by: Maloo Reviewed-by: Liang Zhen Reviewed-by: Amir Shehata --- lnet/klnds/socklnd/socklnd_cb.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lnet/klnds/socklnd/socklnd_cb.c b/lnet/klnds/socklnd/socklnd_cb.c index e945ef2..9db13f8 100644 --- a/lnet/klnds/socklnd/socklnd_cb.c +++ b/lnet/klnds/socklnd/socklnd_cb.c @@ -928,7 +928,7 @@ ksocknal_launch_packet (lnet_ni_t *ni, ksock_tx_t *tx, lnet_process_id_t id) int ksocknal_send(lnet_ni_t *ni, void *private, lnet_msg_t *lntmsg) { - int mpflag = 0; + int mpflag = 1; int type = lntmsg->msg_type; lnet_process_id_t target = lntmsg->msg_target; unsigned int payload_niov = lntmsg->msg_niov; @@ -997,8 +997,9 @@ ksocknal_send(lnet_ni_t *ni, void *private, lnet_msg_t *lntmsg) /* The first fragment will be set later in pro_pack */ rc = ksocknal_launch_packet(ni, tx, target); - if (lntmsg->msg_vmflush) + if (!mpflag) cfs_memory_pressure_restore(mpflag); + if (rc == 0) return (0); -- 1.8.3.1