windows-scache-hash-tables-20080612

LICENSE MIT

Prevent corruption of the cm_data.scacheHashTablep lists when removing
and then re-adding entries to the hash table.  The cm_scache_t nextp
fields were not being reset to NULL which permitted loops to be created.

diff --git a/src/WINNT/afsd/cm_freelance.c b/src/WINNT/afsd/cm_freelance.c
index 873c6139174605ebf79b64a41c2709dee060c767..70290899f4c01ed19cd32a686c164363a986ce92 100644 (file)
--- a/src/WINNT/afsd/cm_freelance.c
+++ b/src/WINNT/afsd/cm_freelance.c
@@ -405,6 +405,7 @@ int cm_reInitLocalMountPoints() {
                      lscpp = &tscp->nextp, tscp = tscp->nextp) {
                     if (tscp == scp) {
                         *lscpp = scp->nextp;
+                        scp->nextp = NULL;
                        lock_ObtainWrite(&scp->rw);
                         scp->flags &= ~CM_SCACHEFLAG_INHASH;
                        lock_ReleaseWrite(&scp->rw);

diff --git a/src/WINNT/afsd/cm_scache.c b/src/WINNT/afsd/cm_scache.c
index 9e6d17cfc89ccdee477aef372562c315a3a28be5..610bd08cc9f5fe7fc608107787fa822d9749377c 100644 (file)
--- a/src/WINNT/afsd/cm_scache.c
+++ b/src/WINNT/afsd/cm_scache.c
@@ -68,6 +68,7 @@ void cm_RemoveSCacheFromHashTable(cm_scache_t *scp)
             lscpp = &tscp->nextp, tscp = tscp->nextp) {
            if (tscp == scp) {
                *lscpp = scp->nextp;
+                scp->nextp = NULL;
                scp->flags &= ~CM_SCACHEFLAG_INHASH;
                break;
            }
@@ -749,8 +750,8 @@ long cm_GetSCache(cm_fid_t *fidp, cm_scache_t **outScpp, cm_user_t *userp,
         scp->dotdotFid.vnode=1;
         scp->flags |= (CM_SCACHEFLAG_PURERO | CM_SCACHEFLAG_RO);
         if (!(scp->flags & CM_SCACHEFLAG_INHASH)) {
-            scp->nextp=cm_data.scacheHashTablep[hash];
-            cm_data.scacheHashTablep[hash]=scp;
+            scp->nextp = cm_data.scacheHashTablep[hash];
+            cm_data.scacheHashTablep[hash] = scp;
             scp->flags |= CM_SCACHEFLAG_INHASH;
         }
         scp->refCount = 1;