client: trim_caps() do not dereference cap if it's removed

this silences the warning of "Use of memory after it is freed" reported
by clang static analyzer.

Reported-by: Brad Hubbard <bhubbard@redhat.com>
Signed-off-by: Kefu Chai <kchai@redhat.com>

diff --git a/src/client/Client.cc b/src/client/Client.cc
index 22ab9ec8631d6234db95141c5af6345ccc5b4d19..94673bc0561ec40d8609f6bd716d3d27df4edda1 100644 (file)
--- a/src/client/Client.cc
+++ b/src/client/Client.cc
@@ -3861,7 +3861,7 @@ void Client::add_update_cap(Inode *in, MetaSession *mds_session, uint64_t cap_id
     signal_cond_list(in->waitfor_caps);
 }
 
-void Client::remove_cap(Cap *cap, bool queue_release)
+Cap* Client::remove_cap(Cap *cap, bool queue_release)
 {
   Inode *in = cap->inode;
   MetaSession *session = cap->session;
@@ -3893,6 +3893,7 @@ void Client::remove_cap(Cap *cap, bool queue_release)
   } else {
     cap->cap_item.remove_myself();
     delete cap;
+    cap = nullptr;
   }
 
   if (!in->is_any_caps()) {
@@ -3901,6 +3902,7 @@ void Client::remove_cap(Cap *cap, bool queue_release)
     put_snap_realm(in->snaprealm);
     in->snaprealm = 0;
   }
+  return cap;
 }
 
 void Client::remove_all_caps(Inode *in)
@@ -3997,7 +3999,7 @@ void Client::trim_caps(MetaSession *s, int max)
       // disposable non-auth cap
       if (!(get_caps_used(in) & ~oissued & mine)) {
        ldout(cct, 20) << " removing unused, unneeded non-auth cap on " << *in << dendl;
-       remove_cap(cap, true);
+       cap = remove_cap(cap, true);
        trimmed++;
       }
     } else {
@@ -4028,7 +4030,7 @@ void Client::trim_caps(MetaSession *s, int max)
     }
 
     ++p;
-    if (!cap->inode) {
+    if (cap && !cap->inode) {
       cap->cap_item.remove_myself();
       delete cap;
     }

diff --git a/src/client/Client.h b/src/client/Client.h
index 81ac751552fa6fc11fc5e2640739fc6ee3941791..3684cc404997ba5b6233e090cd574cfc1abf682d 100644 (file)
--- a/src/client/Client.h
+++ b/src/client/Client.h
@@ -621,7 +621,7 @@ protected:
   void add_update_cap(Inode *in, MetaSession *session, uint64_t cap_id,
                      unsigned issued, unsigned seq, unsigned mseq, inodeno_t realm,
                      int flags, const UserPerm& perms);
-  void remove_cap(Cap *cap, bool queue_release);
+  Cap* remove_cap(Cap *cap, bool queue_release);
   void remove_all_caps(Inode *in);
   void remove_session_caps(MetaSession *session);
   void mark_caps_dirty(Inode *in, int caps);