From: Jeffrey Altman <jaltman@secure-endpoints.com>
Date: Thu, 12 Jun 2008 14:35:06 +0000 (+0000)
Subject: DEVEL15-windows-scache-hash-tables-20080612
X-Git-Tag: openafs-devel-1_5_50~97
X-Git-Url: https://git.michaelhowe.org/gitweb/?a=commitdiff_plain;h=095fdb852003d04fb35b526aa5eee5903ee282bf;p=packages%2Fo%2Fopenafs.git

DEVEL15-windows-scache-hash-tables-20080612

LICENSE MIT

Prevent corruption of the cm_data.scacheHashTablep lists when removing
and then re-adding entries to the hash table.  The cm_scache_t nextp
fields were not being reset to NULL which permitted loops to be created.


(cherry picked from commit ef48d6343d9ac929a4a2ae88184f7801ace1e3d1)
---

diff --git a/src/WINNT/afsd/cm_freelance.c b/src/WINNT/afsd/cm_freelance.c
index a83a6e239..436e16d6a 100644
--- a/src/WINNT/afsd/cm_freelance.c
+++ b/src/WINNT/afsd/cm_freelance.c
@@ -419,6 +419,7 @@ int cm_reInitLocalMountPoints() {
                      lscpp = &tscp->nextp, tscp = tscp->nextp) {
                     if (tscp == scp) {
                         *lscpp = scp->nextp;
+                        scp->nextp = NULL;
 			lock_ObtainWrite(&scp->rw);
                         scp->flags &= ~CM_SCACHEFLAG_INHASH;
 			lock_ReleaseWrite(&scp->rw);
diff --git a/src/WINNT/afsd/cm_scache.c b/src/WINNT/afsd/cm_scache.c
index dcf89acd6..e6d6d9672 100644
--- a/src/WINNT/afsd/cm_scache.c
+++ b/src/WINNT/afsd/cm_scache.c
@@ -70,6 +70,7 @@ void cm_RemoveSCacheFromHashTable(cm_scache_t *scp)
 	     lscpp = &tscp->nextp, tscp = tscp->nextp) {
 	    if (tscp == scp) {
 		*lscpp = scp->nextp;
+                scp->nextp = NULL;
 		scp->flags &= ~CM_SCACHEFLAG_INHASH;
 		break;
 	    }
@@ -751,8 +752,8 @@ long cm_GetSCache(cm_fid_t *fidp, cm_scache_t **outScpp, cm_user_t *userp,
         scp->dotdotFid.vnode=1;
         scp->flags |= (CM_SCACHEFLAG_PURERO | CM_SCACHEFLAG_RO);
         if (!(scp->flags & CM_SCACHEFLAG_INHASH)) {
-            scp->nextp=cm_data.scacheHashTablep[hash];
-            cm_data.scacheHashTablep[hash]=scp;
+            scp->nextp = cm_data.scacheHashTablep[hash];
+            cm_data.scacheHashTablep[hash] = scp;
             scp->flags |= CM_SCACHEFLAG_INHASH;
         }
         scp->refCount = 1;