protocol/server: upon server_connection_put, set xl_private of the transport to

 NULL

 Suppose the get_xlator_by_name returns NULL and the connection is put back
 then update the xl_private of the transport by setting to NULL. Otherwise
 server_connection_put would have freed the connection object and xl_private
 of the transport would still be pointing to the same location which is
 freed, thus leading to a segfault when the location is accessed.

Change-Id: Id47e0edde3073b09765338c730847ba3095df9e2
BUG: 901457
Signed-off-by: Raghavendra Bhat <raghavendra@redhat.com>
Reviewed-on: http://review.gluster.org/4411
Tested-by: Gluster Build System <jenkins@build.gluster.com>
Reviewed-by: Anand Avati <avati@redhat.com>

1 files changed, 10 insertions, 2 deletions

diff --git a/xlators/protocol/server/src/server-handshake.c b/xlators/protocol/server/src/server-handshake.c
index cebc13516a2..330f32be7db 100644
--- a/xlators/protocol/server/src/server-handshake.c
+++ b/xlators/protocol/server/src/server-handshake.c
@@ -673,8 +673,16 @@ fail:
          * list of connections the server is maintaining and might segfault
          * during statedump when bound_xl of the connection is accessed.
          */
-        if (op_ret && conn && !xl)
-                server_connection_put (this, conn, NULL);
+        if (op_ret && conn && !xl) {
+                /* We would have set the xl_private of the transport to the
+                 * @conn. But if we have put the connection i.e shutting down
+                 * the connection, then we should set xl_private to NULL as it
+                 * would be pointing to a freed memory and would segfault when
+                 * accessed upon getting DISCONNECT.
+                 */
+                if (server_connection_put (this, conn, NULL) == NULL)
+                        req->trans->xl_private = NULL;
+        }
         server_submit_reply (NULL, req, &rsp, NULL, 0, NULL,
                              (xdrproc_t)xdr_gf_setvolume_rsp);