LU-17469 llite: hold object reference in IO

There could be a race between page write and inode free, hold
a cl_object reference during the IO lest accessing freed object.

Signed-off-by: Bobi Jam <bobijam@whamcloud.com>
Change-Id: Ic70cc27430e68265aba0662fc68e9bfe2f86cfe1

diff --git a/lustre/llite/file.c b/lustre/llite/file.c
index dcc8a93..4694491 100644 (file)
--- a/lustre/llite/file.c
+++ b/lustre/llite/file.c
@@ -4839,6 +4839,7 @@ int cl_sync_file_range(struct inode *inode, loff_t start, loff_t end,
 
        io = vvp_env_thread_io(env);
        io->ci_obj = ll_i2info(inode)->lli_clob;
+       cl_object_get(io->ci_obj);
        io->ci_ignore_layout = ignore_layout;
 
        /* initialize parameters for sync */
@@ -4856,6 +4857,7 @@ int cl_sync_file_range(struct inode *inode, loff_t start, loff_t end,
        if (result == 0)
                result = fio->fi_nr_written;
        cl_io_fini(env, io);
+       cl_object_put(env, io->ci_obj);
        cl_env_put(env, &refcheck);
 
        RETURN(result);

diff --git a/lustre/llite/rw.c b/lustre/llite/rw.c
index 616b18a..90a36d6 100644 (file)
--- a/lustre/llite/rw.c
+++ b/lustre/llite/rw.c
@@ -1605,7 +1605,7 @@ int ll_writepages(struct address_space *mapping, struct writeback_control *wbc)
 #endif
        }
 
-       if (ll_i2info(inode)->lli_clob == NULL)
+       if (ll_i2info(inode)->lli_clob == NULL || (iinode->i_state & I_FREEING))
                RETURN(0);
 
        /* for directio, it would call writepages() to evict cached pages