perf/qr: Use a ref-ed data to extract content

qr_content_extract used dict_get to get the value of
the GF_CONTENT_KEY key. dict_get does not ref the data
before returning it so QR could be acting on freed memory
if another thread deletes the key before then.
This patch also fixes a race in dict_get_with_ref.

Fix: Use dict_get_with_ref to retrieve the file contents.

Change-Id: Ib1a7a70bb92eed7e70747ec530e0b3edc53127ec
BUG: 1484709
Signed-off-by: N Balachandran <nbalacha@redhat.com>
Reviewed-on: https://review.gluster.org/18115
Smoke: Gluster Build System <jenkins@build.gluster.org>
Reviewed-by: Amar Tumballi <amarts@redhat.com>
Tested-by: Raghavendra G <rgowdapp@redhat.com>
CentOS-regression: Gluster Build System <jenkins@build.gluster.org>
Reviewed-by: Raghavendra G <rgowdapp@redhat.com>

3 files changed, 12 insertions, 10 deletions

diff --git a/libglusterfs/src/dict.c b/libglusterfs/src/dict.c
index 22bf3f99d70..c4f3fb71de3 100644
--- a/libglusterfs/src/dict.c
+++ b/libglusterfs/src/dict.c
@@ -1433,7 +1433,7 @@ fail:
  */
 
 
-static int
+int
 dict_get_with_ref (dict_t *this, char *key, data_t **data)
 {
         data_pair_t * pair = NULL;
@@ -1453,14 +1453,13 @@ dict_get_with_ref (dict_t *this, char *key, data_t **data)
         LOCK (&this->lock);
         {
                 pair = dict_lookup_common (this, key, hash);
-        }
-        UNLOCK (&this->lock);
 
-        if (pair) {
-                ret = 0;
-                *data = data_ref (pair->value);
+                if (pair) {
+                        ret = 0;
+                        *data = data_ref (pair->value);
+                 }
         }
-
+        UNLOCK (&this->lock);
 err:
         return ret;
 }
diff --git a/libglusterfs/src/dict.h b/libglusterfs/src/dict.h
index 93ffa3e8cc7..b1313636092 100644
--- a/libglusterfs/src/dict.h
+++ b/libglusterfs/src/dict.h
@@ -105,6 +105,7 @@ int32_t dict_set (dict_t *this, char *key, data_t *value);
 /* function to set a new key/value pair (without checking for duplicate) */
 int32_t dict_add (dict_t *this, char *key, data_t *value);
 
+int dict_get_with_ref (dict_t *this, char *key, data_t **data);
 data_t *dict_get (dict_t *this, char *key);
 void dict_del (dict_t *this, char *key);
 int dict_reset (dict_t *dict);
diff --git a/xlators/performance/quick-read/src/quick-read.c b/xlators/performance/quick-read/src/quick-read.c
index 8edf495fcdd..92b2f8266ea 100644
--- a/xlators/performance/quick-read/src/quick-read.c
+++ b/xlators/performance/quick-read/src/quick-read.c
@@ -268,17 +268,19 @@ qr_content_extract (dict_t *xdata)
 	data_t  *data = NULL;
 	void    *content = NULL;
 
-	data = dict_get (xdata, GF_CONTENT_KEY);
+	dict_get_with_ref (xdata, GF_CONTENT_KEY, &data);
 	if (!data)
 		return NULL;
 
 	content = GF_CALLOC (1, data->len, gf_qr_mt_content_t);
 	if (!content)
-		return NULL;
+		goto out;
 
 	memcpy (content, data->data, data->len);
 
-	return content;
+out:
+        data_unref (data);
+        return content;
 }