|
 |
21ab4e |
From 5a27594a16307d0b9ab626d7b51514f92e4b7bdd Mon Sep 17 00:00:00 2001
|
|
|
3604df |
From: N Balachandran <nbalacha@redhat.com>
|
|
|
21ab4e |
Date: Thu, 18 May 2017 10:08:43 +0530
|
|
|
21ab4e |
Subject: [PATCH 451/473] cluster/dht: Fix crash in dht rmdir
|
|
|
3604df |
|
|
|
3604df |
Using local->call_cnt to check STACK_WINDs can
|
|
|
3604df |
cause dht_rmdir_do to be called erroneously if
|
|
|
3604df |
dht_rmdir_readdirp_cbk unwinds before we check if
|
|
|
3604df |
local->call_cnt is zero in dht_rmdir_opendir_cbk.
|
|
|
3604df |
This can cause frame corruptions and crashes.
|
|
|
3604df |
|
|
|
3604df |
Thanks to Shyam (srangana@redhat.com) for the
|
|
|
3604df |
analysis.
|
|
|
3604df |
|
|
|
3604df |
> BUG: 1451083
|
|
|
3604df |
> Signed-off-by: N Balachandran <nbalacha@redhat.com>
|
|
|
3604df |
> Reviewed-on: https://review.gluster.org/17305
|
|
|
3604df |
> Smoke: Gluster Build System <jenkins@build.gluster.org>
|
|
|
3604df |
> NetBSD-regression: NetBSD Build System <jenkins@build.gluster.org>
|
|
|
3604df |
> CentOS-regression: Gluster Build System <jenkins@build.gluster.org>
|
|
|
3604df |
> Reviewed-by: Shyamsundar Ranganathan <srangana@redhat.com>
|
|
|
3604df |
|
|
|
21ab4e |
Change-Id: I116dbbffca83a4547b71d922ca99a42f3cf6e009
|
|
|
21ab4e |
BUG: 1451086
|
|
|
3604df |
Signed-off-by: N Balachandran <nbalacha@redhat.com>
|
|
|
21ab4e |
Reviewed-on: https://code.engineering.redhat.com/gerrit/106511
|
|
|
21ab4e |
Reviewed-by: Atin Mukherjee <amukherj@redhat.com>
|
|
|
3604df |
---
|
|
|
21ab4e |
xlators/cluster/dht/src/dht-common.c | 14 ++++++++++----
|
|
|
21ab4e |
1 file changed, 10 insertions(+), 4 deletions(-)
|
|
|
3604df |
|
|
|
3604df |
diff --git a/xlators/cluster/dht/src/dht-common.c b/xlators/cluster/dht/src/dht-common.c
|
|
|
21ab4e |
index 962282a..264ca65 100644
|
|
|
3604df |
--- a/xlators/cluster/dht/src/dht-common.c
|
|
|
3604df |
+++ b/xlators/cluster/dht/src/dht-common.c
|
|
|
21ab4e |
@@ -8646,6 +8646,7 @@ dht_rmdir_opendir_cbk (call_frame_t *frame, void *cookie, xlator_t *this,
|
|
|
21ab4e |
char gfid[GF_UUID_BUF_SIZE] = {0};
|
|
|
3604df |
dht_local_t *readdirp_local = NULL;
|
|
|
3604df |
call_frame_t *readdirp_frame = NULL;
|
|
|
3604df |
+ int cnt = 0;
|
|
|
3604df |
|
|
|
3604df |
local = frame->local;
|
|
|
3604df |
prev = cookie;
|
|
|
21ab4e |
@@ -8688,7 +8689,7 @@ dht_rmdir_opendir_cbk (call_frame_t *frame, void *cookie, xlator_t *this,
|
|
|
3604df |
"%s: Failed to set dictionary value:key = %s",
|
|
|
3604df |
local->loc.path, conf->link_xattr_name);
|
|
|
3604df |
|
|
|
3604df |
- local->call_cnt = conf->subvolume_cnt;
|
|
|
3604df |
+ cnt = local->call_cnt = conf->subvolume_cnt;
|
|
|
3604df |
|
|
|
21ab4e |
|
|
|
3604df |
/* Create a separate frame per subvol as we might need
|
|
|
21ab4e |
@@ -8701,7 +8702,9 @@ dht_rmdir_opendir_cbk (call_frame_t *frame, void *cookie, xlator_t *this,
|
|
|
3604df |
readdirp_frame = copy_frame (frame);
|
|
|
3604df |
|
|
|
3604df |
if (!readdirp_frame) {
|
|
|
3604df |
- local->call_cnt--;
|
|
|
3604df |
+ cnt--;
|
|
|
3604df |
+ /* Reduce the local->call_cnt as well */
|
|
|
3604df |
+ dht_frame_return (frame);
|
|
|
3604df |
continue;
|
|
|
3604df |
}
|
|
|
3604df |
|
|
|
21ab4e |
@@ -8710,7 +8713,9 @@ dht_rmdir_opendir_cbk (call_frame_t *frame, void *cookie, xlator_t *this,
|
|
|
3604df |
|
|
|
3604df |
if (!readdirp_local) {
|
|
|
3604df |
DHT_STACK_DESTROY (readdirp_frame);
|
|
|
3604df |
- local->call_cnt--;
|
|
|
3604df |
+ cnt--;
|
|
|
3604df |
+ /* Reduce the local->call_cnt as well */
|
|
|
3604df |
+ dht_frame_return (frame);
|
|
|
3604df |
continue;
|
|
|
3604df |
}
|
|
|
3604df |
readdirp_local->main_frame = frame;
|
|
|
21ab4e |
@@ -8730,7 +8735,8 @@ dht_rmdir_opendir_cbk (call_frame_t *frame, void *cookie, xlator_t *this,
|
|
|
3604df |
dict_unref (dict);
|
|
|
3604df |
|
|
|
3604df |
/* Could not wind readdirp to any subvol */
|
|
|
3604df |
- if (!local->call_cnt)
|
|
|
3604df |
+
|
|
|
3604df |
+ if (!cnt)
|
|
|
3604df |
goto err;
|
|
|
3604df |
|
|
|
3604df |
return 0;
|
|
|
3604df |
--
|
|
|
3604df |
1.8.3.1
|
|
|
3604df |
|