STABLE14-aix-unpin-after-free-20080520

LICENSE IPL10
FIXES 99456

in order that cleanup be safe we need to do it this way

(cherry picked from commit 3edb97360b7d971750e54471037584d7a9a74993)

diff --git a/src/afs/afs_call.c b/src/afs/afs_call.c
index 7be11b987ecaa1e784da42c01ee7b0d9911bbe89..12be70e95897dae89e5a25094c08675a75b62603 100644 (file)
--- a/src/afs/afs_call.c
+++ b/src/afs/afs_call.c
@@ -2901,10 +2901,10 @@ afs_icl_LogFreeUse(register struct afs_icl_log *logp)
     ObtainWriteLock(&logp->lock, 189);
     if (--logp->setCount == 0) {
        /* no more users -- free it (but keep log structure around) */
+       afs_osi_Free(logp->datap, sizeof(afs_int32) * logp->logSize);
 #ifdef KERNEL_HAVE_PIN
        unpin((char *)logp->datap, sizeof(afs_int32) * logp->logSize);
 #endif
-       afs_osi_Free(logp->datap, sizeof(afs_int32) * logp->logSize);
        logp->firstUsed = logp->firstFree = 0;
        logp->logElements = 0;
        logp->datap = NULL;
@@ -2927,10 +2927,10 @@ afs_icl_LogSetSize(register struct afs_icl_log *logp, afs_int32 logSize)
        logp->logElements = 0;
 
        /* free and allocate a new one */
+       afs_osi_Free(logp->datap, sizeof(afs_int32) * logp->logSize);
 #ifdef KERNEL_HAVE_PIN
        unpin((char *)logp->datap, sizeof(afs_int32) * logp->logSize);
 #endif
-       afs_osi_Free(logp->datap, sizeof(afs_int32) * logp->logSize);
        logp->datap =
            (afs_int32 *) afs_osi_Alloc(sizeof(afs_int32) * logSize);
 #ifdef KERNEL_HAVE_PIN
@@ -2954,10 +2954,10 @@ afs_icl_ZapLog(register struct afs_icl_log *logp)
            /* found the dude we want to remove */
            *lpp = logp->nextp;
            osi_FreeSmallSpace(logp->name);
+           afs_osi_Free(logp->datap, sizeof(afs_int32) * logp->logSize);
 #ifdef KERNEL_HAVE_PIN
            unpin((char *)logp->datap, sizeof(afs_int32) * logp->logSize);
 #endif
-           afs_osi_Free(logp->datap, sizeof(afs_int32) * logp->logSize);
            osi_FreeSmallSpace(logp);
            break;              /* won't find it twice */
        }
@@ -3215,10 +3215,10 @@ afs_icl_ZapSet(register struct afs_icl_set *setp)
            /* found the dude we want to remove */
            *lpp = setp->nextp;
            osi_FreeSmallSpace(setp->name);
+           afs_osi_Free(setp->eventFlags, ICL_DEFAULTEVENTS);
 #ifdef KERNEL_HAVE_PIN
            unpin((char *)setp->eventFlags, ICL_DEFAULTEVENTS);
 #endif
-           afs_osi_Free(setp->eventFlags, ICL_DEFAULTEVENTS);
            for (i = 0; i < ICL_LOGSPERSET; i++) {
                if ((tlp = setp->logs[i]))
                    afs_icl_LogReleNL(tlp);

diff --git a/src/afs/afs_osi_alloc.c b/src/afs/afs_osi_alloc.c
index ac591e686710e1f2666fd1438b1d97114493b67b..82843d0d8d84bb987d336fcc4f98e714430d4b59 100644 (file)
--- a/src/afs/afs_osi_alloc.c
+++ b/src/afs/afs_osi_alloc.c
@@ -146,18 +146,18 @@ shutdown_osinet(void)
 
        while ((tp = freePacketList)) {
            freePacketList = tp->next;
+           afs_osi_Free(tp, AFS_LRALLOCSIZ);
 #ifdef  KERNEL_HAVE_PIN
            unpin(tp, AFS_LRALLOCSIZ);
 #endif
-           afs_osi_Free(tp, AFS_LRALLOCSIZ);
        }
 
        while ((tp = freeSmallList)) {
            freeSmallList = tp->next;
+           afs_osi_Free(tp, AFS_SMALLOCSIZ);
 #ifdef  KERNEL_HAVE_PIN
            unpin(tp, AFS_SMALLOCSIZ);
 #endif
-           afs_osi_Free(tp, AFS_SMALLOCSIZ);
        }
        LOCK_INIT(&osi_fsplock, "osi_fsplock");
        LOCK_INIT(&osi_flplock, "osi_flplock");

diff --git a/src/afs/afs_vcache.c b/src/afs/afs_vcache.c
index 92efef11ecfc7c68dc1d758235ca8490f6c45ee9..3837e680c026a99bab8fec371dcaaef7fe6f4830 100644 (file)
--- a/src/afs/afs_vcache.c
+++ b/src/afs/afs_vcache.c
@@ -3072,12 +3072,12 @@ shutdown_vcache(void)
     }
     afs_cbrSpace = 0;
 
-#ifdef  KERNEL_HAVE_PIN
-    unpin(Initial_freeVCList, afs_cacheStats * sizeof(struct vcache));
-#endif
 #if !defined(AFS_OSF_ENV) && !defined(AFS_LINUX22_ENV)
     afs_osi_Free(Initial_freeVCList, afs_cacheStats * sizeof(struct vcache));
 #endif
+#ifdef  KERNEL_HAVE_PIN
+    unpin(Initial_freeVCList, afs_cacheStats * sizeof(struct vcache));
+#endif
 
 #if !defined(AFS_OSF_ENV) && !defined(AFS_LINUX22_ENV)
     freeVCList = Initial_freeVCList = 0;