[pnfs] [PATCH 09/11] pnfs: BUG: nfs_pagein_multi error handling

[Benny Halevy]

On Apr. 10, 2008, 17:05 +0300, Fred Isaman <iisaman at citi.umich.edu> wrote:
> This just adds a comment noting the bug.  My proposed solution (removing
> the return value from nfs_read_rpcsetup) is in the next patch.
> 
> Signed-off-by: Fred Isaman <iisaman at citi.umich.edu>
> ---
>  fs/nfs/read.c |    7 ++++++-
>  1 files changed, 6 insertions(+), 1 deletions(-)
> 
> diff --git a/fs/nfs/read.c b/fs/nfs/read.c
> index 774a21a..019abb9 100644
> --- a/fs/nfs/read.c
> +++ b/fs/nfs/read.c
> @@ -296,8 +296,13 @@ static int nfs_pagein_multi(struct inode *inode, struct list_head *head, unsigne
>  			rsize = nbytes;
>  		status = nfs_read_rpcsetup(req, data, &nfs_read_partial_ops,
>  					   rsize, offset);
> -		if (status)
> +		if (status) {
> +			/* FIXME - this is broken. Cleanup code assumes
> +			 * nothing  outstanding.  Further, if triggered on
> +			 * last list entry, req will be double-freed.
> +			 */
>  			goto out_bad;
> +		}

As discussed on the conference call, I'm looking into this.
I believe this warrants a generic fix.

Benny

>  		offset += rsize;
>  		nbytes -= rsize;
>  	} while (nbytes != 0);