Free continuation in amfs_retry() if we don't call amfs_bgmount()

Normally it's amfs_bgmount() which frees the continuation. However, if
the mount is already in progress and we're in amfs_retry() for another
node we don't try mounting the filesystem once again. Still, we have
to free the continuation as we won't get called again and thus would
leak the continuation structure and our am_loc references.
From: Krisztian Kovacs <Kris.Kovacs@morganstanley.com>

diff --git a/ChangeLog b/ChangeLog
index 0f6ab8ad3588d8b4ca6fcdf7df0d846fb985c18e..29808612b7cc1448ccf9718f610d29bf05c0226e 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
 2009-12-09  Christos Zoulas <christos@zoulas.com>
 
+       * Free continuation in amfs_retry() if we don't call amfs_bgmount()
+         Normally it's amfs_bgmount() which frees the continuation. However, if
+         the mount is already in progress and we're in amfs_retry() for another
+         node we don't try mounting the filesystem once again. Still, we have
+         to free the continuation as we won't get called again and thus would
+         leak the continuation structure and our am_loc references.
+         From: Krisztian Kovacs <Kris.Kovacs@morganstanley.com>
+
        * Fix use-after-free and double free of mntfs private data
          ops_nfs.c(nfs_init) does not clear private data pointer after free().
          This leads to use-after-free and double free in case mount() fails.

diff --git a/amd/amfs_generic.c b/amd/amfs_generic.c
index e3560b598b1f7f2463a17fed1834bb7f776cedb4..3c604b043b904c00d179c5b9238ea3d6ab1c26ca 100644 (file)
--- a/amd/amfs_generic.c
+++ b/amd/amfs_generic.c
@@ -615,6 +615,14 @@ amfs_retry(int rc, int term, opaque_t arg)
   }
   if (error || !IN_PROGRESS(cp))
     error = amfs_bgmount(cp);
+  else
+    /* Normally it's amfs_bgmount() which frees the continuation. However, if
+     * the mount is already in progress and we're in amfs_retry() for another
+     * node we don't try mounting the filesystem once again. Still, we have
+     * to free the continuation as we won't get called again and thus would
+     * leak the continuation structure and our am_loc references.
+     */
+    free_continuation(cp);
 
   reschedule_timeout_mp();
 }