From 861c70ff6e3371c752d53fcb71cdc54fe74cd3c2 Mon Sep 17 00:00:00 2001 From: wang di Date: Tue, 21 Jul 2015 06:27:24 -0700 Subject: [PATCH 1/1] LU-6875 update: set st to NULL in error handler In thandle_get_sub_by_dt, if create sub thandle fails, it should reset st to NULL, otherwise st, whose value is ERR_PTR(rc), might be freeed incorrectly in the following error handler path. Signed-off-by: wang di Change-Id: I7262593fa5aa6bc3f0ed418aaa5637e84077088b Reviewed-on: http://review.whamcloud.com/15691 Tested-by: Jenkins Reviewed-by: James Simmons Reviewed-by: Andreas Dilger Tested-by: Maloo Reviewed-by: Oleg Drokin --- lustre/target/update_trans.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/lustre/target/update_trans.c b/lustre/target/update_trans.c index 7a3243b..00bc034 100644 --- a/lustre/target/update_trans.c +++ b/lustre/target/update_trans.c @@ -1123,6 +1123,7 @@ struct thandle *thandle_get_sub_by_dt(const struct lu_env *env, struct dt_device *sub_dt) { struct sub_thandle *st = NULL; + struct sub_thandle *master_st = NULL; struct top_thandle *top_th; struct thandle *sub_th = NULL; int rc = 0; @@ -1156,19 +1157,29 @@ struct thandle *thandle_get_sub_by_dt(const struct lu_env *env, /* Add master sub th to the top trans list */ tmt->tmt_master_sub_dt = top_th->tt_master_sub_thandle->th_dev; - st = create_sub_thandle_with_thandle(top_th, - top_th->tt_master_sub_thandle); - if (IS_ERR(st)) - GOTO(stop_trans, rc = PTR_ERR(st)); + master_st = create_sub_thandle_with_thandle(top_th, + top_th->tt_master_sub_thandle); + if (IS_ERR(master_st)) { + rc = PTR_ERR(master_st); + master_st = NULL; + GOTO(stop_trans, rc); + } } /* create and init sub th to the top trans list */ st = create_sub_thandle_with_thandle(top_th, sub_th); + if (IS_ERR(st)) { + rc = PTR_ERR(st); + st = NULL; + GOTO(stop_trans, rc); + } st->st_sub_th->th_wait_submit = 1; stop_trans: if (rc < 0) { - if (st != NULL) - OBD_FREE_PTR(st); + if (master_st != NULL) { + list_del(&master_st->st_sub_list); + OBD_FREE_PTR(master_st); + } sub_th->th_result = rc; dt_trans_stop(env, sub_dt, sub_th); sub_th = ERR_PTR(rc); -- 1.8.3.1