LU-5177 mdt: fix object leak and use after free

[fs/lustre-release.git] / lustre / mdt / mdt_reint.c

diff --git a/lustre/mdt/mdt_reint.c b/lustre/mdt/mdt_reint.c
index 3150e60..2f98026 100644 (file)
--- a/lustre/mdt/mdt_reint.c
+++ b/lustre/mdt/mdt_reint.c
@@ -423,18 +423,19 @@ static int mdt_md_create(struct mdt_thread_info *info)
                if (rc == 0)
                        rc = mdt_attr_get_complex(info, child, ma);
 
-                if (rc == 0) {
-                        /* Return fid & attr to client. */
-                        if (ma->ma_valid & MA_INODE)
-                                mdt_pack_attr2body(info, repbody, &ma->ma_attr,
-                                                   mdt_object_fid(child));
-                }
+               if (rc == 0) {
+                       /* Return fid & attr to client. */
+                       if (ma->ma_valid & MA_INODE)
+                               mdt_pack_attr2body(info, repbody, &ma->ma_attr,
+                                                  mdt_object_fid(child));
+               }
 out_put_child:
-                mdt_object_put(info->mti_env, child);
-        } else {
-                rc = PTR_ERR(child);
-        }
-        mdt_create_pack_capa(info, rc, child, repbody);
+               mdt_create_pack_capa(info, rc, child, repbody);
+               mdt_object_put(info->mti_env, child);
+       } else {
+               rc = PTR_ERR(child);
+               mdt_create_pack_capa(info, rc, NULL, repbody);
+       }
 unlock_parent:
        mdt_object_unlock(info, parent, lh, rc);
 put_parent: