b=23009 Fix access past end of buffer in fsoptions_to_mdt_flags()

[fs/lustre-release.git] / lustre / mdt / mdt_handler.c

diff --git a/lustre/mdt/mdt_handler.c b/lustre/mdt/mdt_handler.c
index 3583a2b..bb61110 100644 (file)
--- a/lustre/mdt/mdt_handler.c
+++ b/lustre/mdt/mdt_handler.c
@@ -448,6 +448,10 @@ void mdt_pack_attr2body(struct mdt_thread_info *info, struct mdt_body *b,
 
         if (info)
                 mdt_body_reverse_idmap(info, b);
+
+        if (b->valid & OBD_MD_FLSIZE)
+                CDEBUG(D_VFSTRACE, DFID": returning size %llu\n",
+                       PFID(fid), b->size);
 }
 
 static inline int mdt_body_has_lov(const struct lu_attr *la,
@@ -1232,15 +1236,20 @@ static int mdt_sendpage(struct mdt_thread_info *info,
         if (OBD_FAIL_CHECK(OBD_FAIL_MDS_SENDPAGE))
                 GOTO(abort_bulk, rc = 0);
 
-        timeout = (int) req->rq_deadline - cfs_time_current_sec();
-        if (timeout < 0)
-                CERROR("Req deadline already passed %lu (now: %lu)\n",
-                       req->rq_deadline, cfs_time_current_sec());
-        *lwi = LWI_TIMEOUT_INTERVAL(cfs_time_seconds(max(timeout, 1)),
-                                    cfs_time_seconds(1), NULL, NULL);
-        rc = l_wait_event(desc->bd_waitq, !ptlrpc_server_bulk_active(desc) ||
-                          exp->exp_failed || exp->exp_abort_active_req, lwi);
-        LASSERT (rc == 0 || rc == -ETIMEDOUT);
+        do {
+                timeout = (int) req->rq_deadline - cfs_time_current_sec();
+                if (timeout < 0)
+                        CERROR("Req deadline already passed %lu (now: %lu)\n",
+                               req->rq_deadline, cfs_time_current_sec());
+                *lwi = LWI_TIMEOUT_INTERVAL(cfs_time_seconds(max(timeout, 1)),
+                                            cfs_time_seconds(1), NULL, NULL);
+                rc = l_wait_event(desc->bd_waitq,
+                                  !ptlrpc_server_bulk_active(desc) ||
+                                  exp->exp_failed ||
+                                  exp->exp_abort_active_req, lwi);
+                LASSERT (rc == 0 || rc == -ETIMEDOUT);
+        } while ((rc == -ETIMEDOUT) &&
+                 (req->rq_deadline > cfs_time_current_sec()));
 
         if (rc == 0) {
                 if (desc->bd_success &&
@@ -3411,6 +3420,8 @@ static int mdt_intent_reint(enum mdt_it_code opcode,
                   * checked here.
                   */
                 if (lustre_handle_is_used(&lhc->mlh_reg_lh)) {
+                        LASSERTF(rc == 0, "Error occurred but lock handle "
+                                 "is still in use\n");
                         rep->lock_policy_res2 = 0;
                         rc = mdt_intent_lock_replace(info, lockp, NULL, lhc, flags);
                         RETURN(rc);
@@ -4439,6 +4450,9 @@ static void fsoptions_to_mdt_flags(struct mdt_device *m, char *options)
                         LCONSOLE_INFO("Disabling ACL\n");
                 }
 
+                if (!*p)
+                        break;
+
                 options = ++p;
         }
 }
@@ -5243,7 +5257,8 @@ static int mdt_upcall(const struct lu_env *env, struct md_device *md,
                                      m->mdt_max_mdsize, m->mdt_max_cookiesize);
                         mdt_allow_cli(m, CONFIG_SYNC);
                         if (data)
-                                (*(__u64 *)data) = m->mdt_lut.lut_mount_count;
+                                (*(__u64 *)data) =
+                                      m->mdt_lut.lut_obd->u.obt.obt_mount_count;
                         break;
                 case MD_NO_TRANS:
                         mti = lu_context_key_get(&env->le_ctx, &mdt_thread_key);