From 7685ba36b1ee34009c4954038373920d269cb2ce Mon Sep 17 00:00:00 2001
From: Bipin Kunal <bkunal@redhat.com>
Date: Tue, 12 May 2015 16:36:55 +0530
Subject: [PATCH 301/304] libgfapi: Gracefully exit when glfd is invalid
Backport of http://review.gluster.org/#/c/10759/
When glfs_* methods operating on glfd are invoked after calling
glfs_close(), the program segfaults inside __GLFS_ENTRY_VALIDATE_FD
trying to deference glfd->fd->inode which is invalid.
Also, returning EBADF seemed more specific than EINVAL.
BUG: 1255471
Change-Id: I13a92dca52da9a300252b69e026581b3a9e931fd
Signed-off-by: Prashanth Pai <ppai@redhat.com>
Reviewed-on: http://review.gluster.org/10759
Tested-by: Gluster Build System <jenkins@build.gluster.com>
Reviewed-by: Shyamsundar Ranganathan <srangana@redhat.com>
Signed-off-by: Bipin Kunal <bkunal@redhat.com>
Reviewed-on: https://code.engineering.redhat.com/gerrit/56191
Reviewed-by: Niels de Vos <ndevos@redhat.com>
Tested-by: Niels de Vos <ndevos@redhat.com>
---
api/src/glfs-internal.h | 4 ++--
api/src/glfs.c | 6 ++++--
libglusterfs/src/fd.c | 2 +-
3 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/api/src/glfs-internal.h b/api/src/glfs-internal.h
index 8ff78de..2d8a7dc 100644
--- a/api/src/glfs-internal.h
+++ b/api/src/glfs-internal.h
@@ -217,8 +217,8 @@ do { \
#define __GLFS_ENTRY_VALIDATE_FD(glfd, label) \
do { \
- if (!glfd) { \
- errno = EINVAL; \
+ if (!glfd || !glfd->fd || !glfd->fd->inode) { \
+ errno = EBADF; \
goto label; \
} \
old_THIS = THIS; \
diff --git a/api/src/glfs.c b/api/src/glfs.c
index 897d3ea..1c7b55a 100644
--- a/api/src/glfs.c
+++ b/api/src/glfs.c
@@ -560,8 +560,10 @@ glfs_fd_destroy (struct glfs_fd *glfd)
}
glfs_unlock (glfd->fs);
- if (glfd->fd)
- fd_unref (glfd->fd);
+ if (glfd->fd) {
+ fd_unref (glfd->fd);
+ glfd->fd = NULL;
+ }
GF_FREE (glfd->readdirbuf);
diff --git a/libglusterfs/src/fd.c b/libglusterfs/src/fd.c
index 85334bb..9beb79c 100644
--- a/libglusterfs/src/fd.c
+++ b/libglusterfs/src/fd.c
@@ -538,7 +538,7 @@ fd_destroy (fd_t *fd)
}
UNLOCK (&fd->inode->lock);
inode_unref (fd->inode);
- fd->inode = (inode_t *)0xaaaaaaaa;
+ fd->inode = NULL;
fd_lk_ctx_unref (fd->lk_ctx);
mem_put (fd);
out:
--
1.7.1