LU-13508 mdc: chlg device could be used after free

[fs/lustre-release.git] / lustre / mdc / mdc_request.c

diff --git a/lustre/mdc/mdc_request.c b/lustre/mdc/mdc_request.c
index 233be24..82d1b5e 100644 (file)
--- a/lustre/mdc/mdc_request.c
+++ b/lustre/mdc/mdc_request.c
@@ -1347,7 +1347,7 @@ static int mdc_read_page_remote(void *data, struct page *page0)
        fid = &op_data->op_fid1;
        LASSERT(inode != NULL);
 
-       OBD_ALLOC(page_pool, sizeof(page_pool[0]) * max_pages);
+       OBD_ALLOC_PTR_ARRAY(page_pool, max_pages);
        if (page_pool != NULL) {
                page_pool[0] = page0;
        } else {
@@ -1416,7 +1416,7 @@ static int mdc_read_page_remote(void *data, struct page *page0)
        }
 
        if (page_pool != &page0)
-               OBD_FREE(page_pool, sizeof(page_pool[0]) * max_pages);
+               OBD_FREE_PTR_ARRAY(page_pool, max_pages);
 
        RETURN(rc);
 }
@@ -1822,6 +1822,7 @@ static int mdc_ioc_hsm_ct_register(struct obd_import *imp, __u32 archive_count,
                *archive_array = archive_count;
 
        ptlrpc_request_set_replen(req);
+       req->rq_no_resend = 1;
 
        rc = mdc_queue_wait(req);
        GOTO(out, rc);
@@ -2994,10 +2995,12 @@ static int __init mdc_init(void)
        rc = class_register_type(&mdc_obd_ops, &mdc_md_ops, true, NULL,
                                 LUSTRE_MDC_NAME, &mdc_device_type);
        if (rc)
-               goto out_dev;
+               goto out_class;
 
        return 0;
 
+out_class:
+       class_destroy(mdc_changelog_class);
 out_dev:
        unregister_chrdev_region(mdc_changelog_dev, MDC_CHANGELOG_DEV_COUNT);
        return rc;
@@ -3005,9 +3008,10 @@ out_dev:
 
 static void __exit mdc_exit(void)
 {
+       class_unregister_type(LUSTRE_MDC_NAME);
        class_destroy(mdc_changelog_class);
        unregister_chrdev_region(mdc_changelog_dev, MDC_CHANGELOG_DEV_COUNT);
-       class_unregister_type(LUSTRE_MDC_NAME);
+       idr_destroy(&mdc_changelog_minor_idr);
 }
 
 MODULE_AUTHOR("OpenSFS, Inc. <http://www.lustre.org/>");