core: use reference counting for mem_acct structures

When freeing memory, our memory-accounting code expects to be able to
dereference from the (previously) allocated block to its owning
translator.  However, as we have already found once in option
validation and twice in logging, that translator might itself have
been freed and the dereference attempt causes on of our daemons to
crash with SIGSEGV.  This patch attempts to fix that as follows:

 * We no longer embed a struct mem_acct directly in a struct xlator,
   but instead allocate it separately.

 * Allocated memory blocks now contain a pointer to the mem_acct
   instead of the xlator.

 * The mem_acct structure contains a reference count, manipulated in
   both the normal and translator allocate/free code using atomic
   increments and decrements.

 * Because it's now a separate structure, we can defer freeing the
   mem_acct until its reference count reaches zero (either way).

 * Some unit tests were disabled, because they embedded their own
   copies of the implementation for what they were supposedly testing.
   Life's too short to spend time fixing tests that seem designed to
   impede progress by requiring a certain implementation as well as
   behavior.

Change-Id: Id929b11387927136f78626901729296b6c0d0fd7
BUG: 1211749
Signed-off-by: Jeff Darcy <jdarcy@redhat.com>
Reviewed-on: http://review.gluster.org/10417
Tested-by: Gluster Build System <jenkins@build.gluster.com>
Reviewed-by: Krishnan Parthasarathi <kparthas@redhat.com>
Reviewed-by: Niels de Vos <ndevos@redhat.com>
Reviewed-by: Pranith Kumar Karampuri <pkarampu@redhat.com>

1 files changed, 23 insertions, 19 deletions

diff --git a/libglusterfs/src/xlator.c b/libglusterfs/src/xlator.c
index c670ee97aee..628f3499956 100644
--- a/libglusterfs/src/xlator.c
+++ b/libglusterfs/src/xlator.c
@@ -509,16 +509,22 @@ xlator_mem_acct_init (xlator_t *xl, int num_types)
         if (!xl->ctx->mem_acct_enable)
                 return 0;
 
-        xl->mem_acct.num_types = num_types;
 
-        xl->mem_acct.rec = CALLOC(num_types, sizeof(struct mem_acct_rec));
+        xl->mem_acct = MALLOC (sizeof(struct mem_acct)
+                               + sizeof(struct mem_acct_rec) * num_types);
 
-        if (!xl->mem_acct.rec) {
+        if (!xl->mem_acct) {
                 return -1;
         }
+        memset (xl->mem_acct, 0, sizeof(struct mem_acct));
+
+        xl->mem_acct->num_types = num_types;
+        LOCK_INIT (&xl->mem_acct->lock);
+        xl->mem_acct->refcnt = 1;
 
         for (i = 0; i < num_types; i++) {
-                ret = LOCK_INIT(&(xl->mem_acct.rec[i].lock));
+                memset (&xl->mem_acct->rec[i], 0, sizeof(struct mem_acct_rec));
+                ret = LOCK_INIT(&(xl->mem_acct->rec[i].lock));
                 if (ret) {
                         fprintf(stderr, "Unable to lock..errno : %d",errno);
                 }
@@ -559,17 +565,22 @@ xlator_list_destroy (xlator_list_t *list)
 static int
 xlator_memrec_free (xlator_t *xl)
 {
-        uint32_t i = 0;
+        uint32_t        i               = 0;
+        struct mem_acct *mem_acct       = NULL;
 
-        if (!xl)
+        if (!xl) {
                 return 0;
+        }
+        mem_acct = xl->mem_acct;
 
-        if (xl->mem_acct.rec) {
-                for (i = 0; i < xl->mem_acct.num_types; i++) {
-                        LOCK_DESTROY (&(xl->mem_acct.rec[i].lock));
+        if (mem_acct) {
+                for (i = 0; i < mem_acct->num_types; i++) {
+                        LOCK_DESTROY (&(mem_acct->rec[i].lock));
+                }
+                if (DECREMENT_ATOMIC (mem_acct->lock, mem_acct->refcnt) == 0) {
+                        FREE (mem_acct);
+                        xl->mem_acct = NULL;
                 }
-                FREE (xl->mem_acct.rec);
-                xl->mem_acct.rec = NULL;
         }
 
         return 0;
@@ -653,7 +664,6 @@ xlator_tree_free_memacct (xlator_t *tree)
 {
         xlator_t *trav = tree;
         xlator_t *prev = tree;
-        int          i = 0;
 
         if (!tree) {
                 gf_log ("parser", GF_LOG_ERROR, "Translator tree not found");
@@ -662,13 +672,7 @@ xlator_tree_free_memacct (xlator_t *tree)
 
         while (prev) {
                 trav = prev->next;
-                if (prev->mem_acct.rec) {
-                        for (i = 0; i < prev->mem_acct.num_types; i++) {
-                                LOCK_DESTROY (&(prev->mem_acct.rec[i].lock));
-                        }
-                        FREE (prev->mem_acct.rec);
-                }
-                GF_FREE (prev);
+                xlator_memrec_free (prev);
                 prev = trav;
         }