Branch: b1_6

Before packing join_file req, all the related reference should be
checked carefully in case some malformed flags cause fake join_file
req on client.
b=14614
i=adilger,johann

diff --git a/lustre/ChangeLog b/lustre/ChangeLog
index b84ca32..2f61ebc 100644 (file)
--- a/lustre/ChangeLog
+++ b/lustre/ChangeLog
@@ -209,6 +209,13 @@ Bugzilla   : 14398
 Description: Allow masking D_WARNING, D_ERROR messages from console
 Details    : Console messages can now be disabled via lnet.printk.
 
+Severity   : normal
+Bugzilla   : 14614
+Description: User code with malformed file open parameter crashes client node 
+Details    : Before packing join_file req, all the related reference should be
+             checked carefully in case some malformed flags cause fake
+            join_file req on client.
+
 --------------------------------------------------------------------------------
 
 2007-12-07         Cluster File Systems, Inc. <info@clusterfs.com>

diff --git a/lustre/mdc/mdc_locks.c b/lustre/mdc/mdc_locks.c
index e171802..d8b3bad 100644 (file)
--- a/lustre/mdc/mdc_locks.c
+++ b/lustre/mdc/mdc_locks.c
@@ -276,7 +276,7 @@ static struct ptlrpc_request *mdc_intent_open_pack(struct obd_export *exp,
                 mode = LCK_CR;
         count += mdc_resource_get_unused(exp, &data->fid1, &cancels, mode,
                                          MDS_INODELOCK_UPDATE);
-        if (it->it_flags & O_JOIN_FILE) {
+        if (it->it_flags & O_JOIN_FILE && data->data) {
                 __u64 head_size = (*(__u64 *)data->data);
                         /* join is like an unlink of the tail */
                 size[DLM_INTENT_REC_OFF + 3] = sizeof(struct mds_rec_join);

diff --git a/lustre/tests/openfile.c b/lustre/tests/openfile.c
index 6cba76b..66aba74 100644 (file)
--- a/lustre/tests/openfile.c
+++ b/lustre/tests/openfile.c
@@ -83,6 +83,16 @@ int main(int argc, char** argv)
                         }
 
                         strncpy(cloned_flags, optarg, strlen(optarg)+1);
+                        flags = atoi(cloned_flags);
+                        if (flags > 0) {
+                                flag_set = 1;
+#ifdef DEBUG
+                                printf("flags = %d\n",flags);
+#endif
+                                break;
+                        } else 
+                                flags = 0;
+                        
                         for (tmp = strtok(cloned_flags, ":|"); tmp;
                              tmp = strtok(NULL, ":|")) {
                                 int i = 0;

diff --git a/lustre/tests/sanity.sh b/lustre/tests/sanity.sh
index 6cd1902..1a9c7a1 100644 (file)
--- a/lustre/tests/sanity.sh
+++ b/lustre/tests/sanity.sh
@@ -1440,6 +1440,14 @@ test_33a() {
 }
 run_test 33a "test open file(mode=0444) with O_RDWR (should return error)"
 
+test_33b() {
+        rm -fr $DIR/d33
+        mkdir -p $DIR/d33
+        chown $RUNAS_ID $DIR/d33
+        $RUNAS $OPENFILE -f 1286739555 $DIR/d33/f33 && error "create" || true
+}
+run_test 33b "test open file with malformed flags (No panic and return error)"
+
 TEST_34_SIZE=${TEST_34_SIZE:-2000000000000}
 test_34a() {
        rm -f $DIR/f34