LU-4833 osd-zfs: object leak in __osd_object_create

[fs/lustre-release.git] / lustre / osd-zfs / osd_object.c

diff --git a/lustre/osd-zfs/osd_object.c b/lustre/osd-zfs/osd_object.c
index fa6fba9..b502585 100644 (file)
--- a/lustre/osd-zfs/osd_object.c
+++ b/lustre/osd-zfs/osd_object.c
@@ -286,7 +286,7 @@ struct lu_object *osd_object_alloc(const struct lu_env *env,
 {
        struct osd_object *mo;
 
-       OBD_SLAB_ALLOC_PTR_GFP(mo, osd_object_kmem, __GFP_IO);
+       OBD_SLAB_ALLOC_PTR_GFP(mo, osd_object_kmem, GFP_NOFS);
        if (mo != NULL) {
                struct lu_object *l;
 
@@ -339,7 +339,7 @@ int osd_object_init0(const struct lu_env *env, struct osd_object *obj)
         */
        obj->oo_dt.do_lu.lo_header->loh_attr |= obj->oo_attr.la_mode & S_IFMT;
 
-       cfs_mb();
+       smp_mb();
        obj->oo_dt.do_lu.lo_header->loh_attr |= LOHA_EXISTS;
 
        RETURN(0);
@@ -874,7 +874,10 @@ static int osd_declare_attr_set(const struct lu_env *env,
        oh = container_of0(handle, struct osd_thandle, ot_super);
 
        LASSERT(obj->oo_sa_hdl != NULL);
+       LASSERT(oh->ot_tx != NULL);
        dmu_tx_hold_sa(oh->ot_tx, obj->oo_sa_hdl, 0);
+       if (oh->ot_tx->tx_err != 0)
+               RETURN(-oh->ot_tx->tx_err);
 
        sa_object_size(obj->oo_sa_hdl, &blksize, &bspace);
        bspace = toqb(bspace * blksize);
@@ -1223,10 +1226,6 @@ int __osd_object_create(const struct lu_env *env, udmu_objset_t *uos,
        int      rc;
 
        LASSERT(tag);
-       spin_lock(&uos->lock);
-       uos->objects++;
-       spin_unlock(&uos->lock);
-
        /* Assert that the transaction has been assigned to a
           transaction group. */
        LASSERT(tx->tx_txg != 0);
@@ -1235,14 +1234,24 @@ int __osd_object_create(const struct lu_env *env, udmu_objset_t *uos,
        oid = dmu_object_alloc(uos->os, DMU_OT_PLAIN_FILE_CONTENTS, 0,
                               DMU_OT_SA, DN_MAX_BONUSLEN, tx);
        rc = -sa_buf_hold(uos->os, oid, tag, dbp);
-       if (rc)
-               return rc;
+       LASSERTF(rc == 0, "sa_buf_hold "LPU64" failed: %d\n", oid, rc);
 
        LASSERT(la->la_valid & LA_MODE);
        la->la_size = 0;
        la->la_nlink = 1;
 
-       return __osd_attr_init(env, uos, oid, tx, la, parent);
+       rc = __osd_attr_init(env, uos, oid, tx, la, parent);
+       if (rc != 0) {
+               sa_buf_rele(*dbp, tag);
+               *dbp = NULL;
+               dmu_object_free(uos->os, oid, tx);
+               return rc;
+       }
+
+       spin_lock(&uos->lock);
+       uos->objects++;
+       spin_unlock(&uos->lock);
+       return 0;
 }
 
 /*
@@ -1488,7 +1497,7 @@ static int osd_object_create(const struct lu_env *env, struct dt_object *dt,
 
        db = osd_create_type_f(dof->dof_type)(env, osd, attr, zapid, oh);
        if (IS_ERR(db))
-               GOTO(out, rc = PTR_ERR(th));
+               GOTO(out, rc = PTR_ERR(db));
 
        zde->zde_pad = 0;
        zde->zde_dnode = db->db_object;
@@ -1748,13 +1757,16 @@ static struct obd_capa *osd_capa_get(const struct lu_env *env,
        RETURN(oc);
 }
 
-static int osd_object_sync(const struct lu_env *env, struct dt_object *dt)
+static int osd_object_sync(const struct lu_env *env, struct dt_object *dt,
+                          __u64 start, __u64 end)
 {
        struct osd_device *osd = osd_obj2dev(osd_dt_obj(dt));
        ENTRY;
 
        /* XXX: no other option than syncing the whole filesystem until we
-        * support ZIL */
+        * support ZIL.  If the object tracked the txg that it was last
+        * modified in, it could pass that txg here instead of "0".  Maybe
+        * the changes are already committed, so no wait is needed at all? */
        txg_wait_synced(dmu_objset_pool(osd->od_objset.os), 0ULL);
 
        RETURN(0);