LU-539 obd_data_connect server side could be corrupted

[fs/lustre-release.git] / lustre / ldlm / ldlm_lib.c

diff --git a/lustre/ldlm/ldlm_lib.c b/lustre/ldlm/ldlm_lib.c
index d0fa1cf..9d063d8 100644 (file)
--- a/lustre/ldlm/ldlm_lib.c
+++ b/lustre/ldlm/ldlm_lib.c
@@ -666,6 +666,7 @@ int target_handle_connect(struct ptlrpc_request *req)
         int rc = 0;
         int mds_conn = 0;
         struct obd_connect_data *data, *tmpdata;
+        int size, tmpsize;
         lnet_nid_t *client_nid = NULL;
         ENTRY;
 
@@ -733,6 +734,8 @@ int target_handle_connect(struct ptlrpc_request *req)
 
         conn = *tmp;
 
+        size = req_capsule_get_size(&req->rq_pill, &RMF_CONNECT_DATA,
+                                    RCL_CLIENT);
         data = req_capsule_client_get(&req->rq_pill, &RMF_CONNECT_DATA);
         if (!data)
                 GOTO(out, rc = -EPROTO);
@@ -926,10 +929,14 @@ dont_check_exports:
         /* Return only the parts of obd_connect_data that we understand, so the
          * client knows that we don't understand the rest. */
         if (data) {
-                 tmpdata = req_capsule_server_get(&req->rq_pill,
-                                                  &RMF_CONNECT_DATA);
-                  //data->ocd_connect_flags &= OBD_CONNECT_SUPPORTED;
-                 *tmpdata = *data;
+                tmpsize = req_capsule_get_size(&req->rq_pill, &RMF_CONNECT_DATA,
+                                               RCL_SERVER);
+                tmpdata = req_capsule_server_get(&req->rq_pill,
+                                                 &RMF_CONNECT_DATA);
+                /* Don't use struct assignment here, because the client reply
+                 * buffer may be smaller/larger than the local struct
+                 * obd_connect_data. */
+                memcpy(tmpdata, data, min(tmpsize, size));
         }
 
         /* If all else goes well, this is our RPC return code. */
@@ -1836,7 +1843,7 @@ static int target_start_recovery_thread(struct lu_target *lut,
         cfs_init_completion(&trd->trd_finishing);
         trd->trd_recovery_handler = handler;
 
-        if (cfs_kernel_thread(target_recovery_thread, lut, 0) > 0) {
+        if (cfs_create_thread(target_recovery_thread, lut, 0) > 0) {
                 cfs_wait_for_completion(&trd->trd_starting);
                 LASSERT(obd->obd_recovering != 0);
         } else