b=6223

This should fix the crash (need to use vfree, not kfree).  But it won't
allow lfs getstripe to work for 420 OSTs -- OBD_MAX_IOCTL_BUFFER of 8k allows a
max of around 180 OBDs.

diff --git a/lustre/include/linux/lustre_lib.h b/lustre/include/linux/lustre_lib.h
index 86e0274..8807574 100644 (file)
--- a/lustre/include/linux/lustre_lib.h
+++ b/lustre/include/linux/lustre_lib.h
@@ -330,25 +330,23 @@ static inline int obd_ioctl_getdata(char **buf, int *len, void *arg)
         ENTRY;
 
         err = copy_from_user(&hdr, (void *)arg, sizeof(hdr));
-        if ( err ) {
-                EXIT;
-                return err;
-        }
+        if (err) 
+                RETURN(err);
 
         if (hdr.ioc_version != OBD_IOCTL_VERSION) {
                 CERROR("Version mismatch kernel vs application\n");
-                return -EINVAL;
+                RETURN(-EINVAL);
         }
 
         if (hdr.ioc_len > OBD_MAX_IOCTL_BUFFER) {
                 CERROR("User buffer len %d exceeds %d max buffer\n",
                        hdr.ioc_len, OBD_MAX_IOCTL_BUFFER);
-                return -EINVAL;
+                RETURN(-EINVAL);
         }
 
         if (hdr.ioc_len < sizeof(struct obd_ioctl_data)) {
-                printk("LustreError: OBD: user buffer too small for ioctl\n");
-                return -EINVAL;
+                CERROR("user buffer too small for ioctl (%d)\n", hdr.ioc_len);
+                RETURN(-EINVAL);
         }
 
         /* XXX allocate this more intelligently, using kmalloc when
@@ -363,14 +361,15 @@ static inline int obd_ioctl_getdata(char **buf, int *len, void *arg)
         data = (struct obd_ioctl_data *)*buf;
 
         err = copy_from_user(*buf, (void *)arg, hdr.ioc_len);
-        if ( err ) {
-                EXIT;
-                return err;
+        if (err) {
+                OBD_VFREE(*buf, hdr.ioc_len);
+                RETURN(err);
         }
 
         if (obd_ioctl_is_invalid(data)) {
                 CERROR("ioctl not correctly formatted\n");
-                return -EINVAL;
+                OBD_VFREE(*buf, hdr.ioc_len);
+                RETURN(-EINVAL);
         }
 
         if (data->ioc_inllen1) {
@@ -392,8 +391,7 @@ static inline int obd_ioctl_getdata(char **buf, int *len, void *arg)
                 data->ioc_inlbuf4 = &data->ioc_bulk[0] + offset;
         }
 
-        EXIT;
-        return 0;
+        RETURN(0);
 }
 
 static inline void obd_ioctl_freedata(char *buf, int len)

diff --git a/lustre/lov/lov_obd.c b/lustre/lov/lov_obd.c
index da25941..d6e228d 100644 (file)
--- a/lustre/lov/lov_obd.c
+++ b/lustre/lov/lov_obd.c
@@ -1841,17 +1841,17 @@ static int lov_iocontrol(unsigned int cmd, struct obd_export *exp, int len,
                 data = (struct obd_ioctl_data *)buf;
 
                 if (sizeof(*desc) > data->ioc_inllen1) {
-                        OBD_FREE(buf, len);
+                        obd_ioctl_freedata(buf, len);
                         RETURN(-EINVAL);
                 }
 
                 if (sizeof(uuidp->uuid) * count > data->ioc_inllen2) {
-                        OBD_FREE(buf, len);
+                        obd_ioctl_freedata(buf, len);
                         RETURN(-EINVAL);
                 }
 
                 if (sizeof(__u32) * count > data->ioc_inllen3) {
-                        OBD_FREE(buf, len);
+                        obd_ioctl_freedata(buf, len);
                         RETURN(-EINVAL);
                 }