|
 |
d1681e |
From 76823d120518528c4edad4af6f4c1cdd50f5b398 Mon Sep 17 00:00:00 2001
|
|
|
d1681e |
From: Mohit Agrawal <moagrawal@redhat.com>
|
|
|
d1681e |
Date: Tue, 24 Jul 2018 14:48:35 +0530
|
|
|
d1681e |
Subject: [PATCH 332/333] rpc: rpc_clnt_connection_cleanup is crashed due to
|
|
|
d1681e |
double free
|
|
|
d1681e |
|
|
|
d1681e |
Problem: gfapi client is getting crashed in rpc_clnt_connection_cleanup
|
|
|
d1681e |
at the time of destroying saved_frames
|
|
|
d1681e |
|
|
|
d1681e |
Solution: gfapi client is getting crashed because saved_frame ptr is
|
|
|
d1681e |
already freed in rpc_clnt_destroy.To avoid the same update
|
|
|
d1681e |
code in rpc_clnt_destroy
|
|
|
d1681e |
|
|
|
d1681e |
> Change-Id: Id8cce102b49f26cfd86ef88257032ed98f43192b
|
|
|
d1681e |
> fixes: bz#1607783
|
|
|
d1681e |
> (cherry picked from commit abd7b1393294d29eef6913e7f93ab76040c90428)
|
|
|
d1681e |
> (Reviewed on upstream link https://review.gluster.org/#/c/20557/)
|
|
|
d1681e |
|
|
|
d1681e |
Change-Id: Id3200e36acc1c49a8f5d39a1cc5053864899754c
|
|
|
d1681e |
BUG: 1600790
|
|
|
d1681e |
Signed-off-by: Mohit Agrawal <moagrawal@redhat.com>
|
|
|
d1681e |
Reviewed-on: https://code.engineering.redhat.com/gerrit/145377
|
|
|
d1681e |
Tested-by: Mohit Agrawal <moagrawa@redhat.com>
|
|
|
d1681e |
Reviewed-by: Niels de Vos <ndevos@redhat.com>
|
|
|
d1681e |
Tested-by: RHGS Build Bot <nigelb@redhat.com>
|
|
|
d1681e |
---
|
|
|
d1681e |
rpc/rpc-lib/src/rpc-clnt.c | 20 +++++++++++++++++---
|
|
|
d1681e |
1 file changed, 17 insertions(+), 3 deletions(-)
|
|
|
d1681e |
|
|
|
d1681e |
diff --git a/rpc/rpc-lib/src/rpc-clnt.c b/rpc/rpc-lib/src/rpc-clnt.c
|
|
|
d1681e |
index 1ea8099..fd7e3ec 100644
|
|
|
d1681e |
--- a/rpc/rpc-lib/src/rpc-clnt.c
|
|
|
d1681e |
+++ b/rpc/rpc-lib/src/rpc-clnt.c
|
|
|
d1681e |
@@ -1771,13 +1771,27 @@ rpc_clnt_trigger_destroy (struct rpc_clnt *rpc)
|
|
|
d1681e |
static void
|
|
|
d1681e |
rpc_clnt_destroy (struct rpc_clnt *rpc)
|
|
|
d1681e |
{
|
|
|
d1681e |
- rpcclnt_cb_program_t *program = NULL;
|
|
|
d1681e |
- rpcclnt_cb_program_t *tmp = NULL;
|
|
|
d1681e |
+ rpcclnt_cb_program_t *program = NULL;
|
|
|
d1681e |
+ rpcclnt_cb_program_t *tmp = NULL;
|
|
|
d1681e |
+ struct saved_frames *saved_frames = NULL;
|
|
|
d1681e |
+ rpc_clnt_connection_t *conn = NULL;
|
|
|
d1681e |
|
|
|
d1681e |
if (!rpc)
|
|
|
d1681e |
return;
|
|
|
d1681e |
|
|
|
d1681e |
- saved_frames_destroy (rpc->conn.saved_frames);
|
|
|
d1681e |
+ conn = &rpc->conn;
|
|
|
d1681e |
+ /* Access saved_frames in critical-section to avoid
|
|
|
d1681e |
+ crash in rpc_clnt_connection_cleanup at the time
|
|
|
d1681e |
+ of destroying saved frames
|
|
|
d1681e |
+ */
|
|
|
d1681e |
+ pthread_mutex_lock (&conn->lock);
|
|
|
d1681e |
+ {
|
|
|
d1681e |
+ saved_frames = conn->saved_frames;
|
|
|
d1681e |
+ conn->saved_frames = NULL;
|
|
|
d1681e |
+ }
|
|
|
d1681e |
+ pthread_mutex_unlock (&conn->lock);
|
|
|
d1681e |
+
|
|
|
d1681e |
+ saved_frames_destroy (saved_frames);
|
|
|
d1681e |
pthread_mutex_destroy (&rpc->lock);
|
|
|
d1681e |
pthread_mutex_destroy (&rpc->conn.lock);
|
|
|
d1681e |
|
|
|
d1681e |
--
|
|
|
d1681e |
1.8.3.1
|
|
|
d1681e |
|