check buffer present first, then check length, and then get buffer.

diff --git a/lustre/mdt/mdt_handler.c b/lustre/mdt/mdt_handler.c
index bf09b94..17c0d6f 100644 (file)
--- a/lustre/mdt/mdt_handler.c
+++ b/lustre/mdt/mdt_handler.c
@@ -1456,8 +1456,11 @@ static int mdt_body_unpack(struct mdt_thread_info *info, __u32 flags)
          * contains capa actually. There are some requests which do not, for
          * instance MDS_IS_SUBDIR.
          */
-        if (req_capsule_has_field(pill, &RMF_CAPA1, RCL_CLIENT))
-                capa = req_capsule_client_get(pill, &RMF_CAPA1);
+        if (req_capsule_field_present(pill, &RMF_CAPA1, RCL_CLIENT)) {
+                int len = req_capsule_get_size(pill, &RMF_CAPA1, RCL_CLIENT);
+                if (len == sizeof(struct lustre_capa)) 
+                        capa = req_capsule_client_get(pill, &RMF_CAPA1);
+        }
         
         obj = mdt_object_find(env, info->mti_mdt, &body->fid1, capa);
         if (!IS_ERR(obj)) {