pNFS/flexfiles: Check the layout validity in ff_layout_mirror_prepare_stats

commit e1c6cfbb3bd1377e2ddcbe06cf8fb1ec323ea7d3 upstream.

Ensure that we check the layout pointer and validity after dereferencing
it in ff_layout_mirror_prepare_stats.

Fixes: 08e2e5bc6c9a ("pNFS/flexfiles: Clean up layoutstats")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 5c69a6e9ab3e1d837d38ed55dce506e9a968f511..81bbafab18a99751238719912a9b7981fd9a2c01 100644 (file)
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -2520,9 +2520,9 @@ ff_layout_mirror_prepare_stats(struct pnfs_layout_hdr *lo,
        return i;
 }
 
-static int
-ff_layout_prepare_layoutstats(struct nfs42_layoutstat_args *args)
+static int ff_layout_prepare_layoutstats(struct nfs42_layoutstat_args *args)
 {
+       struct pnfs_layout_hdr *lo;
        struct nfs4_flexfile_layout *ff_layout;
        const int dev_count = PNFS_LAYOUTSTATS_MAXDEV;
 
@@ -2533,11 +2533,14 @@ ff_layout_prepare_layoutstats(struct nfs42_layoutstat_args *args)
                return -ENOMEM;
 
        spin_lock(&args->inode->i_lock);
-       ff_layout = FF_LAYOUT_FROM_HDR(NFS_I(args->inode)->layout);
-       args->num_dev = ff_layout_mirror_prepare_stats(&ff_layout->generic_hdr,
-                                                      &args->devinfo[0],
-                                                      dev_count,
-                                                      NFS4_FF_OP_LAYOUTSTATS);
+       lo = NFS_I(args->inode)->layout;
+       if (lo && pnfs_layout_is_valid(lo)) {
+               ff_layout = FF_LAYOUT_FROM_HDR(lo);
+               args->num_dev = ff_layout_mirror_prepare_stats(
+                       &ff_layout->generic_hdr, &args->devinfo[0], dev_count,
+                       NFS4_FF_OP_LAYOUTSTATS);
+       } else
+               args->num_dev = 0;
        spin_unlock(&args->inode->i_lock);
        if (!args->num_dev) {
                kfree(args->devinfo);