features/marker: Fix memory corruption.

Signed-off-by: Junaid <junaid@gluster.com>
Signed-off-by: Vijay Bellur <vijay@dev.gluster.com>

BUG: 2629 ()
URL: http://bugs.gluster.com/cgi-bin/bugzilla3/show_bug.cgi?id=2629

5 files changed, 24 insertions, 17 deletions

diff --git a/libglusterfs/src/glusterfs.h b/libglusterfs/src/glusterfs.h
index 7c1d681e9..56b5e2b9c 100644
--- a/libglusterfs/src/glusterfs.h
+++ b/libglusterfs/src/glusterfs.h
@@ -91,6 +91,8 @@
 #define GLUSTERFS_INODELK_COUNT "glusterfs.inodelk-count"
 #define GLUSTERFS_ENTRYLK_COUNT "glusterfs.entrylk-count"
 #define GLUSTERFS_POSIXLK_COUNT "glusterfs.posixlk-count"
+#define QUOTA_SIZE_KEY "trusted.glusterfs.quota.size"
+
 #define GLUSTERFS_RDMA_INLINE_THRESHOLD       (2048)
 #define GLUSTERFS_RDMA_MAX_HEADER_SIZE        (228) /* (sizeof (rdma_header_t)                 \
                                                        + RDMA_MAX_SEGMENTS \
diff --git a/xlators/features/marker/src/marker-common.c b/xlators/features/marker/src/marker-common.c
index 3e2d7f000..855fb9936 100644
--- a/xlators/features/marker/src/marker-common.c
+++ b/xlators/features/marker/src/marker-common.c
@@ -49,13 +49,14 @@ marker_force_inode_ctx_get (inode_t *inode, xlator_t *this,
         {
                 ret = __inode_ctx_get (inode, this, &ctx_int);
                 if (ret == 0)
-                        *ctx = (marker_inode_ctx_t *) ctx_int;
+                        *ctx = (marker_inode_ctx_t *) (unsigned long)ctx_int;
                 else {
                         *ctx = marker_inode_ctx_new ();
                         if (*ctx == NULL)
                                 goto unlock;
 
-                        ret = __inode_ctx_put (inode, this, (uint64_t ) *ctx);
+                        ret = __inode_ctx_put (inode, this,
+                                               (uint64_t )(unsigned long) *ctx);
                         if (ret == -1) {
                                 GF_FREE (*ctx);
                                 goto unlock;
diff --git a/xlators/features/marker/src/marker-quota.c b/xlators/features/marker/src/marker-quota.c
index 629c5de48..4d5fed66e 100644
--- a/xlators/features/marker/src/marker-quota.c
+++ b/xlators/features/marker/src/marker-quota.c
@@ -98,6 +98,8 @@ release_lock_on_dirty_inode (call_frame_t *frame, void *cookie, xlator_t *this,
         struct gf_flock   lock;
         quota_local_t    *local = NULL;
 
+        local = frame->local;
+
         if (op_ret == -1) {
                 local->err = -1;
 
@@ -106,8 +108,6 @@ release_lock_on_dirty_inode (call_frame_t *frame, void *cookie, xlator_t *this,
                 return 0;
         }
 
-        local = frame->local;
-
         if (op_ret == 0)
                 local->ctx->dirty = 0;
 
@@ -136,13 +136,13 @@ mark_inode_undirty (call_frame_t *frame, void *cookie, xlator_t *this,
         quota_local_t *local     = NULL;
         marker_conf_t  *priv      = NULL;
 
+        local = (quota_local_t *) frame->local;
+
         if (op_ret == -1)
                 goto err;
 
         priv = (marker_conf_t *) this->private;
 
-        local = (quota_local_t *) frame->local;
-
         if (!dict)
                 goto wind;
 
@@ -288,6 +288,7 @@ get_child_contribution (call_frame_t *frame,
                         struct iatt *postparent)
 {
         int32_t          ret            = -1;
+	int32_t		 val	 	= 0;
         char             contri_key [512] = {0, };
         int64_t         *contri         = NULL;
         quota_local_t   *local          = NULL;
@@ -324,11 +325,11 @@ get_child_contribution (call_frame_t *frame,
 out:
         LOCK (&local->lock);
         {
-                local->dentry_child_count--;
+                val = local->dentry_child_count--;
         }
         UNLOCK (&local->lock);
 
-        if (local->dentry_child_count == 0) {
+        if (val== 0) {
                 if (local->err) {
                         QUOTA_SAFE_DECREMENT (&local->lock, local->ref);
 
@@ -1377,12 +1378,12 @@ start_quota_txn (xlator_t *this, loc_t *loc,
 
         ret = loc_copy (&local->loc, loc);
         if (ret < 0)
-                goto local_unref;
+                goto fr_destroy;
 
         ret = quota_inode_loc_fill (NULL, local->loc.parent,
                                     &local->parent_loc);
         if (ret < 0)
-                goto local_unref;
+                goto fr_destroy;
 
         local->ctx = ctx;
         local->contri = contri;
@@ -1391,9 +1392,6 @@ start_quota_txn (xlator_t *this, loc_t *loc,
 
         return 0;
 
-local_unref:
-        quota_local_unref (this, local);
-
 fr_destroy:
         QUOTA_STACK_DESTROY (frame, this);
 
@@ -1557,7 +1555,7 @@ inspect_file_xattr (xlator_t *this,
 
                 ret = dict_get_bin (dict, contri_key, (void **) &contri_int);
                 if (ret == 0) {
-                        contri_ptr = (int64_t *) contri_int;
+                        contri_ptr = (int64_t *)(unsigned long)contri_int;
 
                         contribution->contribution = ntoh64 (*contri_ptr);
 
diff --git a/xlators/features/marker/src/marker-quota.h b/xlators/features/marker/src/marker-quota.h
index 4e2e480ab..e709bcac2 100644
--- a/xlators/features/marker/src/marker-quota.h
+++ b/xlators/features/marker/src/marker-quota.h
@@ -29,8 +29,8 @@
 #include "marker-mem-types.h"
 
 #define QUOTA_XATTR_PREFIX "trusted.glusterfs"
-#define QUOTA_SIZE_KEY "trusted.glusterfs.quota.size"
 #define QUOTA_DIRTY_KEY "trusted.glusterfs.quota.dirty"
+
 #define CONTRIBUTION "contri"
 #define VOL_NAME volname
 #define CONTRI_KEY_MAX 512
diff --git a/xlators/features/marker/src/marker.c b/xlators/features/marker/src/marker.c
index 43bb58cd8..4062b8d0b 100644
--- a/xlators/features/marker/src/marker.c
+++ b/xlators/features/marker/src/marker.c
@@ -1886,11 +1886,17 @@ err:
 int32_t
 marker_forget (xlator_t *this, inode_t *inode)
 {
-        marker_inode_ctx_t      *ctx = NULL;
+        marker_inode_ctx_t *ctx   = NULL;
+        uint64_t            value = 0;
 
-        if (inode_ctx_del (inode, this, (uint64_t *) &ctx) != 0)
+        if (inode_ctx_del (inode, this, &value) != 0)
                 goto out;
 
+        ctx = (marker_inode_ctx_t *)(unsigned long)value;
+        if (ctx == NULL) {
+                goto out;
+        }
+
         quota_forget (this, ctx->quota_ctx);
 
         GF_FREE (ctx);