LU-5305 ldlm: fix a use after free in ldlm_resource_get()

[fs/lustre-release.git] / lustre / ldlm / ldlm_resource.c

diff --git a/lustre/ldlm/ldlm_resource.c b/lustre/ldlm/ldlm_resource.c
index ae70626..5f6a645 100644 (file)
--- a/lustre/ldlm/ldlm_resource.c
+++ b/lustre/ldlm/ldlm_resource.c
@@ -1077,6 +1077,7 @@ ldlm_resource_get(struct ldlm_namespace *ns, struct ldlm_resource *parent,
        cfs_hash_bd_t           bd;
        __u64                   version;
        int                     ns_refcount = 0;
        cfs_hash_bd_t           bd;
        __u64                   version;
        int                     ns_refcount = 0;

+       int                     rc;

 
         LASSERT(ns != NULL);
         LASSERT(parent == NULL);
 
         LASSERT(ns != NULL);
         LASSERT(parent == NULL);


@@ -1128,8 +1129,9 @@ lvbo_init:
                }
 
                if (unlikely(res->lr_lvb_len < 0)) {
                }
 
                if (unlikely(res->lr_lvb_len < 0)) {

+                       rc = res->lr_lvb_len;

                        ldlm_resource_putref(res);
                        ldlm_resource_putref(res);

-                       res = ERR_PTR(res->lr_lvb_len);
+                       res = ERR_PTR(rc);

                }
                return res;
        }
                }
                return res;
        }


@@ -1140,8 +1142,6 @@ lvbo_init:
 
         cfs_hash_bd_unlock(ns->ns_rs_hash, &bd, 1);
         if (ns->ns_lvbo && ns->ns_lvbo->lvbo_init) {
 
         cfs_hash_bd_unlock(ns->ns_rs_hash, &bd, 1);
         if (ns->ns_lvbo && ns->ns_lvbo->lvbo_init) {

-                int rc;
-

                 OBD_FAIL_TIMEOUT(OBD_FAIL_LDLM_CREATE_RESOURCE, 2);
                 rc = ns->ns_lvbo->lvbo_init(res);
                if (rc < 0) {
                 OBD_FAIL_TIMEOUT(OBD_FAIL_LDLM_CREATE_RESOURCE, 2);
                 rc = ns->ns_lvbo->lvbo_init(res);
                if (rc < 0) {