e3c68b
From 30cbdf8c06145a0c290da42ecc0a7eae928200b7 Mon Sep 17 00:00:00 2001
e3c68b
From: Xavi Hernandez <xhernandez@redhat.com>
e3c68b
Date: Sun, 8 Mar 2020 18:36:45 +0100
e3c68b
Subject: [PATCH 374/375] open-behind: fix missing fd reference
e3c68b
e3c68b
Open behind was not keeping any reference on fd's pending to be
e3c68b
opened. This makes it possible that a concurrent close and en entry
e3c68b
fop (unlink, rename, ...) caused destruction of the fd while it
e3c68b
was still being used.
e3c68b
e3c68b
Upstream patch:
e3c68b
> Upstream patch link: https://review.gluster.org/c/glusterfs/+/24204
e3c68b
> Change-Id: Ie9e992902cf2cd7be4af1f8b4e57af9bd6afd8e9
e3c68b
> Fixes: bz#1810934
e3c68b
> Signed-off-by: Xavi Hernandez <xhernandez@redhat.com>
e3c68b
e3c68b
Change-Id: Ie9e992902cf2cd7be4af1f8b4e57af9bd6afd8e9
e3c68b
BUG: 1830713
e3c68b
Signed-off-by: Xavi Hernandez <xhernandez@redhat.com>
e3c68b
Reviewed-on: https://code.engineering.redhat.com/gerrit/199714
e3c68b
Tested-by: RHGS Build Bot <nigelb@redhat.com>
e3c68b
Reviewed-by: Sunil Kumar Heggodu Gopala Acharya <sheggodu@redhat.com>
e3c68b
---
e3c68b
 xlators/performance/open-behind/src/open-behind.c | 27 ++++++++++++++---------
e3c68b
 1 file changed, 16 insertions(+), 11 deletions(-)
e3c68b
e3c68b
diff --git a/xlators/performance/open-behind/src/open-behind.c b/xlators/performance/open-behind/src/open-behind.c
e3c68b
index 268c717..14ebc12 100644
e3c68b
--- a/xlators/performance/open-behind/src/open-behind.c
e3c68b
+++ b/xlators/performance/open-behind/src/open-behind.c
e3c68b
@@ -206,8 +206,13 @@ ob_fd_free(ob_fd_t *ob_fd)
e3c68b
     if (ob_fd->xdata)
e3c68b
         dict_unref(ob_fd->xdata);
e3c68b
 
e3c68b
-    if (ob_fd->open_frame)
e3c68b
+    if (ob_fd->open_frame) {
e3c68b
+        /* If we sill have a frame it means that background open has never
e3c68b
+         * been triggered. We need to release the pending reference. */
e3c68b
+        fd_unref(ob_fd->fd);
e3c68b
+
e3c68b
         STACK_DESTROY(ob_fd->open_frame->root);
e3c68b
+    }
e3c68b
 
e3c68b
     GF_FREE(ob_fd);
e3c68b
 }
e3c68b
@@ -297,6 +302,7 @@ ob_wake_cbk(call_frame_t *frame, void *cookie, xlator_t *this, int op_ret,
e3c68b
             call_resume(stub);
e3c68b
     }
e3c68b
 
e3c68b
+    /* The background open is completed. We can release the 'fd' reference. */
e3c68b
     fd_unref(fd);
e3c68b
 
e3c68b
     STACK_DESTROY(frame->root);
e3c68b
@@ -331,7 +337,9 @@ ob_fd_wake(xlator_t *this, fd_t *fd, ob_fd_t *ob_fd)
e3c68b
     }
e3c68b
 
e3c68b
     if (frame) {
e3c68b
-        frame->local = fd_ref(fd);
e3c68b
+        /* We don't need to take a reference here. We already have a reference
e3c68b
+         * while the open is pending. */
e3c68b
+        frame->local = fd;
e3c68b
 
e3c68b
         STACK_WIND(frame, ob_wake_cbk, FIRST_CHILD(this),
e3c68b
                    FIRST_CHILD(this)->fops->open, &ob_fd->loc, ob_fd->flags, fd,
e3c68b
@@ -345,15 +353,12 @@ void
e3c68b
 ob_inode_wake(xlator_t *this, struct list_head *ob_fds)
e3c68b
 {
e3c68b
     ob_fd_t *ob_fd = NULL, *tmp = NULL;
e3c68b
-    fd_t *fd = NULL;
e3c68b
 
e3c68b
     if (!list_empty(ob_fds)) {
e3c68b
         list_for_each_entry_safe(ob_fd, tmp, ob_fds, ob_fds_on_inode)
e3c68b
         {
e3c68b
             ob_fd_wake(this, ob_fd->fd, ob_fd);
e3c68b
-            fd = ob_fd->fd;
e3c68b
             ob_fd_free(ob_fd);
e3c68b
-            fd_unref(fd);
e3c68b
         }
e3c68b
     }
e3c68b
 }
e3c68b
@@ -365,7 +370,7 @@ ob_fd_copy(ob_fd_t *src, ob_fd_t *dst)
e3c68b
     if (!src || !dst)
e3c68b
         goto out;
e3c68b
 
e3c68b
-    dst->fd = __fd_ref(src->fd);
e3c68b
+    dst->fd = src->fd;
e3c68b
     dst->loc.inode = inode_ref(src->loc.inode);
e3c68b
     gf_uuid_copy(dst->loc.gfid, src->loc.gfid);
e3c68b
     dst->flags = src->flags;
e3c68b
@@ -509,7 +514,6 @@ ob_open_behind(call_frame_t *frame, xlator_t *this, loc_t *loc, int flags,
e3c68b
 
e3c68b
     ob_fd->ob_inode = ob_inode;
e3c68b
 
e3c68b
-    /* don't do fd_ref, it'll cause leaks */
e3c68b
     ob_fd->fd = fd;
e3c68b
 
e3c68b
     ob_fd->open_frame = copy_frame(frame);
e3c68b
@@ -539,15 +543,16 @@ ob_open_behind(call_frame_t *frame, xlator_t *this, loc_t *loc, int flags,
e3c68b
     }
e3c68b
     UNLOCK(&fd->inode->lock);
e3c68b
 
e3c68b
-    if (!open_in_progress && !unlinked) {
e3c68b
-        fd_ref(fd);
e3c68b
+    /* We take a reference while the background open is pending or being
e3c68b
+     * processed. If we finally wind the request in the foreground, then
e3c68b
+     * ob_fd_free() will take care of this additional reference. */
e3c68b
+    fd_ref(fd);
e3c68b
 
e3c68b
+    if (!open_in_progress && !unlinked) {
e3c68b
         STACK_UNWIND_STRICT(open, frame, 0, 0, fd, xdata);
e3c68b
 
e3c68b
         if (!conf->lazy_open)
e3c68b
             ob_fd_wake(this, fd, NULL);
e3c68b
-
e3c68b
-        fd_unref(fd);
e3c68b
     } else {
e3c68b
         ob_fd_free(ob_fd);
e3c68b
         STACK_WIND(frame, default_open_cbk, FIRST_CHILD(this),
e3c68b
-- 
e3c68b
1.8.3.1
e3c68b