STABLE14-windows-scache-ref-leak-20061010

if cm_FindSCache is called the returned scache object
must be released.

(cherry picked from commit c60736030bc7f7a678fc44af90d001cd8c08acf5)

diff --git a/src/WINNT/afsd/cm_buf.c b/src/WINNT/afsd/cm_buf.c
index 82e62e69c3c01fd62a1d4880fc42fdf11f1cd3e6..aabd3498f0f8d1d4ce1f22b998e62ed0e1db8dd3 100644 (file)
--- a/src/WINNT/afsd/cm_buf.c
+++ b/src/WINNT/afsd/cm_buf.c
@@ -439,6 +439,8 @@ void buf_Release(cm_buf_t *bp)
  */
 void buf_WaitIO(cm_scache_t * scp, cm_buf_t *bp)
 {
+    int release = 0;
+
     if (scp)
         osi_assert(scp->magic == CM_SCACHE_MAGIC);
     osi_assert(bp->magic == CM_BUF_MAGIC);
@@ -475,7 +477,8 @@ void buf_WaitIO(cm_scache_t * scp, cm_buf_t *bp)
         }
 
         if ( !scp ) {
-            scp = cm_FindSCache(&bp->fid);
+            if (scp = cm_FindSCache(&bp->fid))
+                release = 1;
         }
         if ( scp ) {
             lock_ObtainMutex(&scp->mx);
@@ -495,6 +498,9 @@ void buf_WaitIO(cm_scache_t * scp, cm_buf_t *bp)
         osi_Wakeup((long) bp);
     }
     osi_Log1(afsd_logp, "WaitIO finished wait for bp 0x%x", (long) bp);
+
+    if (scp && release)
+        cm_ReleaseSCache(scp);
 }
 
 /* code to drop reference count while holding buf_globalLock */