--- ./source/private_module/omnilock/nas_brl_s.c	2021-12-17 07:58:42.000000000 +0000
+++ ./source/private_module/omnilock/nas_brl_s.c.hotpatch	2021-12-17 08:02:46.901707348 +0000
@@ -918,15 +918,14 @@
 STATIC uint64_t serv_brl_grace_timeout_scan(void)
 {
     NAS_SERVER_BRL_RES *brlres = NULL;
-    uint64_t cur = get_jiffies_64();
+    uint64_t cur = get_jiffies_64(); uint64_t condInterval = jiffies + 1*HZ;
     uint64_t delay = 3*HZ;
-    
     spin_lock(&serv_brl_grace_info.brl_grace_lock);   
     while (!list_empty(&serv_brl_grace_info.brl_grace_head))
     {
         brlres = list_first_entry(&serv_brl_grace_info.brl_grace_head, NAS_SERVER_BRL_RES, gracelist);
-        if (cur < brlres->expire)
-        {
+        if (cur < brlres->expire) 
+		{
             delay = brlres->expire - cur;
             break;
         }
@@ -935,6 +934,7 @@
         atomic64_dec(&serv_brl_stat->gracenum);
         spin_unlock(&serv_brl_grace_info.brl_grace_lock);
         serv_brl_end_grace(brlres);
+        if (time_after(jiffies, condInterval)) {cond_resched(); condInterval = jiffies + 1*HZ; NAS_DBG(MOD_NAS_LOCK, LOG_WARNING, "Scan overtime 1 second, curTime is %llu.", condInterval);}
         spin_lock(&serv_brl_grace_info.brl_grace_lock);
     }
     spin_unlock(&serv_brl_grace_info.brl_grace_lock);
--- ./source/private_module/omnilock/nas_open_lock_s.c	2021-12-17 07:59:30.000000000 +0000
+++ ./source/private_module/omnilock/nas_open_lock_s.c.hotpatch	2021-12-17 08:02:46.853707348 +0000
@@ -2166,7 +2166,7 @@
 *****************************************************************************/
 STATIC int nas_open_mig_unpack_base(NAS_SERVER_OPEN_RES *openres, void *buf, uint32_t length)
 {
-    MSG_HDR msghdr;
+    MSG_HDR msghdr = {0};
     NAS_SERVER_OPEN_BASE_REQ *msg = NULL;
     NAS_SERVER_OPEN_BASE_REQ local_msg;
     int ret = 0;
@@ -2342,8 +2342,7 @@
 {
     uint32_t openlength = 0;
     NAS_SERVER_RES *sres = (NAS_SERVER_RES *)res;
-    NAS_SERVER_OPEN_RES *openres = &sres->open;  
-
+    NAS_SERVER_OPEN_RES *openres = &sres->open; uint32_t left_len = 0;
     /* ˳ NAS_SERVER_OPEN_BASE_REQ(72)+granted(12*x)+waited */
     spin_lock(&openres->lock);
     openlength = (uint32_t)sizeof(NAS_SERVER_OPEN_BASE_REQ) 
@@ -2353,8 +2352,9 @@
     NAS_DBG(MOD_NAS_LOCK, LOG_INFO, "Locks: open base pack length is %u.", openlength);
 
     /* bufΪձֻȡȲ */
-    if(NULL != buf)
-    {
+    if(NULL != buf) {
+        left_len = dlmGetMemChainLen(buf);
+        if (left_len < openlength) {spin_unlock(&openres->lock); NAS_DBG(MOD_NAS_LOCK, LOG_WARNING, "Locks: open lock mig failed, left len %u, need len %u.", left_len, openlength); return -1;}
         atomic64_inc(&srv_open_stat.basemignum);
         nas_open_mig_pack_base(openres, buf, openlength);
         openres->migstatus = NAS_SERVER_RES_MIGRATING;
@@ -2414,16 +2414,16 @@
     uint32_t openlength = 0;
     NAS_SERVER_RES *sres = (NAS_SERVER_RES *)res;
     NAS_SERVER_OPEN_RES *openres = &sres->open;  
-    
+    uint32_t left_len = 0;
     /* ˳ NAS_SERVER_OPEN_INC_REQ(4) + OPEN_LOCK_INC_INFO(20*x)  */
     spin_lock(&openres->lock);
     openlength = (uint32_t)sizeof(NAS_SERVER_OPEN_INC_REQ)
                  +(uint32_t)sizeof(OPEN_LOCK_INC_INFO)*(uint32_t)atomic_read(&openres->increq_num);
     *packlen = openlength;
     NAS_DBG(MOD_NAS_LOCK, LOG_INFO, "Locks: open inc pack length is %u.", openlength);
-
-    if(NULL != buf)
-    {
+    if(NULL != buf) {
+        left_len = dlmGetMemChainLen(buf); 
+        if (left_len < openlength) {spin_unlock(&openres->lock); NAS_DBG(MOD_NAS_LOCK, LOG_WARNING, "Locks: open lock mig failed, left len %u, need len %u.", left_len, openlength); return -1;}
         atomic64_inc(&srv_open_stat.incmignum);
         nas_open_mig_pack_inc(openres, buf, openlength);
         openres->migstatus = NAS_SERVER_RES_NORMAL;
--- ./source/private_module/omnilock/nas_open_lock_c.c	2021-12-17 07:59:30.000000000 +0000
+++ ./source/private_module/omnilock/nas_open_lock_c.c.hotpatch	2021-12-17 08:02:46.849707348 +0000
@@ -3677,7 +3677,7 @@
     NAS_RES_C *res = (NAS_RES_C *)resc;
     NAS_RECOVERY_MSG msg;
     uint32_t flag = 0;
-
+    uint32_t left_len = 0;
     atomic64_inc(&clnt_open_lock_stat->recovery);
 
     NAS_RESC_DUMP(res, LOG_INFO, "lock recovery", 0);
@@ -3690,18 +3690,18 @@
     /* ָ  ϶ɹ */  
     flag |= OMNI_LOCK_FLAG_RECOVERY;
     msg.flag = flag;
-
     msg.openinfo.hdr.type = NAS_LOCK_OPEN;
     msg.openinfo.hdr.baslen = sizeof(OPEN_RECOVERY_MSG);
     msg.openinfo.hdr.lenth = sizeof(OPEN_RECOVERY_MSG);
     msg.openinfo.modebit = res->openlock.open.grantModeBits;
-    
     /* ָ϶͵proxy  ͷԴʱҪ͵master */
     set_bit(OPEN_RES_FLAG_SENDED, &res->openlock.flag);
-    
     *len += sizeof(NAS_RECOVERY_MSG);
-    if (unlikely(NULL != buf))
-    {
+    if (unlikely(NULL != buf)){
+        left_len = dlmGetMemChainLen(buf);
+        if (left_len < sizeof(NAS_RECOVERY_MSG)) {
+		    NAS_DBG(MOD_NAS_LOCK, LOG_WARNING, "Locks: open lock mig failed, left len %u, need len %u.", left_len, *len); return -1;
+        }
         (void)dlmWriteMemChain(buf, (uint8_t *)&msg, (uint32_t)sizeof(NAS_RECOVERY_MSG));
     }
     NAS_DBG(MOD_NAS_LOCK, LOG_INFO, "Lockc: flag %x, modebit %x,len %u, fid %llu.", 
@@ -4868,12 +4868,12 @@
     
     openNum = atomic_read(&res->openlock.grantNum) + atomic_read(&res->openlock.evtNum);
     setNum = atomic_read(&clnt_open_percent) * nas_lock_open_num / 100;
+    setNum = setNum > 100000 ? 100000 : setNum;
     if(openNum >= setNum)  
     {
         NAS_DBG(MOD_NAS_LOCK, LOG_WARNING, "Lockc: openNum(%llu) extend set openNum(%llu).", openNum, setNum);
         return true;
     }
-
     return false;
 #else
     (void)res;
--- ./source/private_module/omnilock/nas_lock_s.c	2021-12-17 07:59:30.000000000 +0000
+++ ./source/private_module/omnilock/nas_lock_s.c.hotpatch	2021-12-17 08:02:46.841707348 +0000
@@ -647,19 +647,18 @@
     NAS_SERVER_BASE_REQ baseReq;
     int type = 0;
     int ret = 0;
-    uint32_t length = 0;
+    uint32_t length = 0;uint32_t left_len = 0;
     NAS_DBG(MOD_NAS_LOCK, LOG_INFO, "Locks: func in.");
-    if (!nas_svr_check_res(sres))
-    {
+    if (!nas_svr_check_res(sres)) {
         return -EINVAL;
     }
     *packlen = 0;
-   
     baseReq.magic = RESS_MAGIC;
     baseReq.ref = atomic_read(&sres->ref.refcount);
     /* ͷ ,bufΪձֻȡȲ */
     if(NULL != buf) 
     {
+		left_len = dlmGetMemChainLen(buf); if (left_len < (uint32_t)sizeof(NAS_SERVER_BASE_REQ)) {NAS_DBG(MOD_NAS_LOCK, LOG_WARNING, "Locks: mig svr faile, left len %u, need len %u.", left_len, (uint32_t)sizeof(NAS_SERVER_BASE_REQ)); return -1;}
         (void)dlmWriteMemChain(buf, (uint8_t *)&baseReq, (uint32_t)sizeof(NAS_SERVER_BASE_REQ));
     }
     *packlen += sizeof(NAS_SERVER_BASE_REQ);
@@ -668,6 +667,7 @@
     {
         length = nas_svr_mig_get_mig_length(type, sres, buf, NAS_SVR_MIG_TYPE_BASE, &ret);
         NAS_DBG(MOD_NAS_LOCK, LOG_INFO, "Locks: type %d, length %d, ret %d.",type, length, ret);
+		if (ret == -1) {return -1;}//mislenth, need dlm retry;
         *packlen += length;
         
     }
@@ -742,17 +742,16 @@
     NAS_SERVER_INC_REQ incReq;
     int type = 0;
     int ret = 0;
-    uint32_t length = 0;
+    uint32_t length = 0;uint32_t left_len = 0;
     NAS_DBG(MOD_NAS_LOCK, LOG_INFO, "Locks: func in.");
-    if (!nas_svr_check_res(sres))
-    {
+    if (!nas_svr_check_res(sres)) {
         return -EINVAL;
     }
     *packlen = 0;
     incReq.magic = RESS_MAGIC;
     /* ͷ ,bufΪձֻȡȲ */
-    if(NULL != buf) 
-    {
+    if(NULL != buf) {
+		left_len = dlmGetMemChainLen(buf); if (left_len < (uint32_t)sizeof(NAS_SERVER_INC_REQ)) {NAS_DBG(MOD_NAS_LOCK, LOG_WARNING, "Locks: mig svr faile, left len %u, need len %u.", left_len, (uint32_t)sizeof(NAS_SERVER_INC_REQ)); return -1;}//mislenth, need dlm retry;
         (void)dlmWriteMemChain(buf, (uint8_t *)&incReq, (uint32_t)sizeof(NAS_SERVER_INC_REQ));
     }
     *packlen += sizeof(NAS_SERVER_INC_REQ);
@@ -761,6 +760,7 @@
     {
         length = nas_svr_mig_get_mig_length(type, sres, buf, NAS_SVR_MIG_TYPE_INC, &ret);
         NAS_DBG(MOD_NAS_LOCK, LOG_INFO, "Locks: type %d, length %d, ret %d.",type, length, ret);
+		if (ret == -1) {return -1;}
         *packlen += length;
         
     }
