[Devel,vz7] ploop: fix typo in ploop_pb_get_first_req_from_tree

Submitted by Maxim Patlasov on July 13, 2017, 12:52 a.m.

Details

Message ID 149990708500.14921.14097201477216710238.stgit@maxim-thinkpad
State New
Series "ploop: fix typo in ploop_pb_get_first_req_from_tree"
Headers show

Commit Message

Maxim Patlasov July 13, 2017, 12:52 a.m. 
Due to a typo, local pointer was defined as static leading to a nasty race:

1. Thread A (handling ploopN) initializes that pointer
2. Thread B (handling ploopM) re-initialize the same pointer
3. Thread A proceeds with using the pointer that currently points to
some request belonging to ploopM.

Hence data (ploop requests) leaked from one ploop device to another
leading to list corruption.

https://jira.sw.ru/browse/PSBM-67513

Signed-off-by: Maxim Patlasov <mpatlasov@virtuozzo.com>
---
 drivers/block/ploop/push_backup.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Patch hide | download patch | download mbox 

diff --git a/drivers/block/ploop/push_backup.c b/drivers/block/ploop/push_backup.c
index ade5fa5..032706e 100644
--- a/drivers/block/ploop/push_backup.c
+++ b/drivers/block/ploop/push_backup.c
@@ -598,7 +598,7 @@  ploop_pb_get_first_req_from_tree(struct pb_set *pbs,
 				 unsigned old_owner)
 {
 	struct rb_root *tree = &pbs->tree;
-	static struct ploop_request *p;
+	struct ploop_request *p;
 	struct rb_node *n = rb_first(tree);
 
 	if (!n)

Comments

Konstantin Khorenko July 13, 2017, 8:53 a.m. 
This is the most "classic" case i remember.
When so hard to find issue results again in a so tiny fix.

Maxim, thank you for finding this out at last!

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

On 07/13/2017 03:52 AM, Maxim Patlasov wrote:
> Due to a typo, local pointer was defined as static leading to a nasty race:
>
> 1. Thread A (handling ploopN) initializes that pointer
> 2. Thread B (handling ploopM) re-initialize the same pointer
> 3. Thread A proceeds with using the pointer that currently points to
> some request belonging to ploopM.
>
> Hence data (ploop requests) leaked from one ploop device to another
> leading to list corruption.
>
> https://jira.sw.ru/browse/PSBM-67513
>
> Signed-off-by: Maxim Patlasov <mpatlasov@virtuozzo.com>
> ---
>  drivers/block/ploop/push_backup.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/block/ploop/push_backup.c b/drivers/block/ploop/push_backup.c
> index ade5fa5..032706e 100644
> --- a/drivers/block/ploop/push_backup.c
> +++ b/drivers/block/ploop/push_backup.c
> @@ -598,7 +598,7 @@ ploop_pb_get_first_req_from_tree(struct pb_set *pbs,
>  				 unsigned old_owner)
>  {
>  	struct rb_root *tree = &pbs->tree;
> -	static struct ploop_request *p;
> +	struct ploop_request *p;
>  	struct rb_node *n = rb_first(tree);
>
>  	if (!n)
>
> .
>