in md_capainfo, mc_fid contains at most 5 pointers to lu_fid,
and if the corresponding lu_fid is freed, the pointer isn't notified
about it, then the pointer will point to freed memory!
Signed-off-by: Hongchao Zhang <hongchao.zhang@whamcloud.com>
Change-Id: I00088cbfeb145ceac0477467a8b2436f6cf1e530
Reviewed-on: http://review.whamcloud.com/1979
Tested-by: Hudson
Tested-by: Maloo <whamcloud.maloo@gmail.com>
Reviewed-by: Mikhail Pershin <tappro@whamcloud.com>
Reviewed-by: wangdi <di.wang@whamcloud.com>
Reviewed-by: Oleg Drokin <green@whamcloud.com>
struct md_capainfo {
__u32 mc_auth;
__u32 mc_padding;
struct md_capainfo {
__u32 mc_auth;
__u32 mc_padding;
- const struct lu_fid *mc_fid[MD_CAPAINFO_MAX];
+ struct lu_fid mc_fid[MD_CAPAINFO_MAX];
struct lustre_capa *mc_capa[MD_CAPAINFO_MAX];
};
struct lustre_capa *mc_capa[MD_CAPAINFO_MAX];
};
if (!ci)
return BYPASS_CAPA;
for (i = 0; i < MD_CAPAINFO_MAX; i++)
if (!ci)
return BYPASS_CAPA;
for (i = 0; i < MD_CAPAINFO_MAX; i++)
- if (ci->mc_fid[i] && lu_fid_eq(ci->mc_fid[i], fid))
+ if (lu_fid_eq(&ci->mc_fid[i], fid))
return ci->mc_capa[i];
return NULL;
}
return ci->mc_capa[i];
return NULL;
}
/* NB: in mdt_init0 */
if (!ci)
return;
/* NB: in mdt_init0 */
if (!ci)
return;
- ci->mc_fid[offset] = fid;
+ ci->mc_fid[offset] = *fid;
ci->mc_capa[offset] = capa;
}
ci->mc_capa[offset] = capa;
}
ci = md_capainfo(info->mti_env);
LASSERT(ci);
ci = md_capainfo(info->mti_env);
LASSERT(ci);
- ci->mc_fid[offset] = fid;
+ ci->mc_fid[offset] = *fid;
ci->mc_capa[offset] = capa;
}
ci->mc_capa[offset] = capa;
}
if (!ci)
return;
for (i = 0; i < MD_CAPAINFO_MAX; i++) {
if (!ci)
return;
for (i = 0; i < MD_CAPAINFO_MAX; i++) {
- if (!ci->mc_fid[i])
- continue;
if (!ci->mc_capa[i]) {
CERROR("no capa for index %d "DFID"\n",
if (!ci->mc_capa[i]) {
CERROR("no capa for index %d "DFID"\n",
- i, PFID(ci->mc_fid[i]));
+ i, PFID(&ci->mc_fid[i]));
continue;
}
if (ci->mc_capa[i] == BYPASS_CAPA) {
CERROR("bypass for index %d "DFID"\n",
continue;
}
if (ci->mc_capa[i] == BYPASS_CAPA) {
CERROR("bypass for index %d "DFID"\n",
- i, PFID(ci->mc_fid[i]));
+ i, PFID(&ci->mc_fid[i]));
continue;
}
DEBUG_CAPA(D_ERROR, ci->mc_capa[i], "index %d", i);
continue;
}
DEBUG_CAPA(D_ERROR, ci->mc_capa[i], "index %d", i);