LU-12581 osc: prevent use after free

Clear aa_oa after it's been freed to prevent use after free.

Lustre-change: https://review.whamcloud.com/35601
Lustre-commit: 61c9f8797771c951ecd240981d7d97d5adc685e0

Signed-off-by: Bobi Jam <bobijam@whamcloud.com>
Change-Id: Idf122aa53fe5b13c07337745e5a26763e8712be2
Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
Reviewed-by: Patrick Farrell <pfarrell@whamcloud.com>
Signed-off-by: Minh Diep <mdiep@whamcloud.com>
Reviewed-on: https://review.whamcloud.com/36210
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: Oleg Drokin <green@whamcloud.com>

diff --git a/lustre/osc/osc_request.c b/lustre/osc/osc_request.c
index 2e8d9d7..ac63212 100644 (file)
--- a/lustre/osc/osc_request.c
+++ b/lustre/osc/osc_request.c
@@ -757,6 +757,7 @@ static int osc_shrink_grant_interpret(const struct lu_env *env,
        osc_update_grant(cli, body);
 out:
        OBD_SLAB_FREE_PTR(oa, osc_obdo_kmem);
+       oa = NULL;
        return rc;
 }
 
@@ -2106,6 +2107,7 @@ static int brw_interpret(const struct lu_env *env,
                cl_object_attr_unlock(obj);
        }
        OBD_SLAB_FREE_PTR(aa->aa_oa, osc_obdo_kmem);
+       aa->aa_oa = NULL;
 
        if (lustre_msg_get_opc(req->rq_reqmsg) == OST_WRITE && rc == 0)
                osc_inc_unstable_pages(req);