pump, afr: dict related memory fixes.

Signed-off-by: Krishnan Parthasarathi <kp@gluster.com>
Signed-off-by: Anand Avati <avati@gluster.com>

BUG: 2489 (GlusterFS crashing with replace-brick)
URL: http://bugs.gluster.com/cgi-bin/bugzilla3/show_bug.cgi?id=2489

3 files changed, 106 insertions, 42 deletions

diff --git a/xlators/cluster/afr/src/afr-self-heal-data.c b/xlators/cluster/afr/src/afr-self-heal-data.c
index 13aa054dc75..f4cc4275de5 100644
--- a/xlators/cluster/afr/src/afr-self-heal-data.c
+++ b/xlators/cluster/afr/src/afr-self-heal-data.c
@@ -844,7 +844,7 @@ afr_sh_data_fxattrop (call_frame_t *frame, xlator_t *this)
         afr_local_t     *local = NULL;
         afr_private_t   *priv  = NULL;
         dict_t          *xattr_req = NULL;
-        int32_t zero_pending[3] = {0,};
+        int32_t         *zero_pending = NULL;
         int call_count = 0;
         int i = 0;
         int ret = 0;
@@ -859,13 +859,27 @@ afr_sh_data_fxattrop (call_frame_t *frame, xlator_t *this)
         local->call_count = call_count;
 
         xattr_req = dict_new();
-        if (xattr_req) {
-                for (i = 0; i < priv->child_count; i++) {
-                        ret = dict_set_static_bin (xattr_req, priv->pending_key[i],
-                                                   zero_pending, 3 * sizeof(int32_t));
-                        if (ret < 0)
-                                gf_log (this->name, GF_LOG_WARNING,
-                                        "Unable to set dict value");
+        if (!xattr_req) {
+                ret = -1;
+                goto out;
+        }
+
+        for (i = 0; i < priv->child_count; i++) {
+                zero_pending = GF_CALLOC (3, sizeof (*zero_pending),
+                                          gf_afr_mt_int32_t);
+                if (!zero_pending) {
+                        ret = -1;
+                        goto out;
+                }
+                ret = dict_set_dynptr (xattr_req, priv->pending_key[i],
+                                       zero_pending,
+                                       3 * sizeof (*zero_pending));
+                if (ret < 0) {
+                        gf_log (this->name, GF_LOG_WARNING,
+                                "Unable to set dict value");
+                        goto out;
+                } else {
+                        zero_pending = NULL;
                 }
         }
 
@@ -883,13 +897,20 @@ afr_sh_data_fxattrop (call_frame_t *frame, xlator_t *this)
                 }
         }
 
+out:
         if (xattr_req)
                 dict_unref (xattr_req);
 
+        if (ret) {
+                if (zero_pending)
+                        GF_FREE (zero_pending);
+                sh->op_failed = 1;
+                afr_sh_data_done (frame, this);
+        }
+
         return 0;
 }
 
-
 int
 afr_sh_data_lock_rec (call_frame_t *frame, xlator_t *this);
 
diff --git a/xlators/cluster/afr/src/afr-self-heal-entry.c b/xlators/cluster/afr/src/afr-self-heal-entry.c
index 289ad274816..ca738098a3e 100644
--- a/xlators/cluster/afr/src/afr-self-heal-entry.c
+++ b/xlators/cluster/afr/src/afr-self-heal-entry.c
@@ -1056,7 +1056,7 @@ afr_sh_entry_impunge_newfile_cbk (call_frame_t *impunge_frame, void *cookie,
         call_frame_t    *frame            = NULL;
         int              active_src       = 0;
         int              child_index      = 0;
-        int              pending_array[3] = {0, };
+        int32_t         *pending_array    = NULL;
         dict_t          *xattr            = NULL;
         int              ret              = 0;
         int              idx              = 0;
@@ -1078,6 +1078,7 @@ afr_sh_entry_impunge_newfile_cbk (call_frame_t *impunge_frame, void *cookie,
         child_index = (long) cookie;
 
         if (op_ret == -1) {
+                ret = -1;
                 gf_log (this->name, GF_LOG_ERROR,
                         "creation of %s on %s failed (%s)",
                         impunge_local->loc.path,
@@ -1088,9 +1089,19 @@ afr_sh_entry_impunge_newfile_cbk (call_frame_t *impunge_frame, void *cookie,
 
         inode->ia_type = stbuf->ia_type;
 
-        xattr = get_new_dict ();
-        dict_ref (xattr);
+        xattr = dict_new ();
+        if (!xattr) {
+                ret = -1;
+                goto out;
+        }
+
+        pending_array = (int32_t*) GF_CALLOC (3, sizeof (*pending_array),
+                                              gf_afr_mt_int32_t);
 
+        if (!pending_array) {
+                ret = -1;
+                goto out;
+        }
         idx = afr_index_for_transaction_type (AFR_METADATA_TRANSACTION);
         pending_array[idx] = hton32 (1);
         if (IA_ISDIR (stbuf->ia_type))
@@ -1099,11 +1110,15 @@ afr_sh_entry_impunge_newfile_cbk (call_frame_t *impunge_frame, void *cookie,
                 idx = afr_index_for_transaction_type (AFR_DATA_TRANSACTION);
         pending_array[idx] = hton32 (1);
 
-        ret = dict_set_static_bin (xattr, priv->pending_key[child_index],
-                                   pending_array, sizeof (pending_array));
-        if (ret < 0)
+        ret = dict_set_dynptr (xattr, priv->pending_key[child_index],
+                               pending_array,
+                               3 * sizeof (*pending_array));
+        if (ret < 0) {
                 gf_log (this->name, GF_LOG_WARNING,
                         "Unable to set dict value.");
+        } else {
+                pending_array = NULL;
+        }
 
         valid         = GF_SET_ATTR_ATIME | GF_SET_ATTR_MTIME;
         parentbuf     = impunge_sh->parentbuf;
@@ -1111,6 +1126,10 @@ afr_sh_entry_impunge_newfile_cbk (call_frame_t *impunge_frame, void *cookie,
 
         parent_loc = GF_CALLOC (1, sizeof (*parent_loc),
                                 gf_afr_mt_loc_t);
+        if (!parent_loc) {
+                ret = -1;
+                goto out;
+        }
         afr_build_parent_loc (parent_loc, &impunge_local->loc);
 
         STACK_WIND_COOKIE (impunge_frame, afr_sh_entry_impunge_xattrop_cbk,
@@ -1125,20 +1144,24 @@ afr_sh_entry_impunge_newfile_cbk (call_frame_t *impunge_frame, void *cookie,
                            priv->children[child_index]->fops->setattr,
                            parent_loc, &parentbuf, valid);
 
-        dict_unref (xattr);
+out:
+        if (xattr)
+                dict_unref (xattr);
 
-        return 0;
+        if (ret) {
+                if (pending_array)
+                        GF_FREE (pending_array);
 
-out:
-        LOCK (&impunge_frame->lock);
-        {
-                call_count = --impunge_local->call_count;
-        }
-        UNLOCK (&impunge_frame->lock);
+                LOCK (&impunge_frame->lock);
+                {
+                        call_count = --impunge_local->call_count;
+                }
+                UNLOCK (&impunge_frame->lock);
 
-        if (call_count == 0) {
-                AFR_STACK_DESTROY (impunge_frame);
-                afr_sh_entry_impunge_entry_done (frame, this, active_src);
+                if (call_count == 0) {
+                        AFR_STACK_DESTROY (impunge_frame);
+                        afr_sh_entry_impunge_entry_done (frame, this, active_src);
+                }
         }
 
         return 0;
diff --git a/xlators/cluster/afr/src/pump.c b/xlators/cluster/afr/src/pump.c
index 873fc8bde8a..48ce2c94568 100644
--- a/xlators/cluster/afr/src/pump.c
+++ b/xlators/cluster/afr/src/pump.c
@@ -893,7 +893,8 @@ pump_initiate_sink_connect (call_frame_t *frame, xlator_t *this)
         afr_local_t   *local     = NULL;
         afr_private_t *priv      = NULL;
         dict_t        *dict      = NULL;
-        char          *dst_brick = NULL;
+        data_t        *data      = NULL;
+        char          *clnt_cmd  = NULL;
         loc_t loc = {0};
 
         int ret = 0;
@@ -905,8 +906,9 @@ pump_initiate_sink_connect (call_frame_t *frame, xlator_t *this)
 
         build_root_loc (priv->root_inode, &loc);
 
-        ret = dict_get_str (local->dict, PUMP_CMD_START, &dst_brick);
-        if (ret < 0) {
+        data = data_ref (dict_get (local->dict, PUMP_CMD_START));
+        if (!data) {
+                ret = -1;
                 gf_log (this->name, GF_LOG_ERROR,
                         "Could not get destination brick value");
                 goto out;
@@ -914,17 +916,22 @@ pump_initiate_sink_connect (call_frame_t *frame, xlator_t *this)
 
         dict = dict_new ();
         if (!dict) {
-                gf_log (this->name, GF_LOG_ERROR,
-                        "Out of memory");
                 ret = -1;
                 goto out;
         }
 
-        GF_ASSERT (dst_brick);
-        gf_log (this->name, GF_LOG_DEBUG,
-                "Got destination brick as %s", dst_brick);
+        clnt_cmd = GF_CALLOC (1, data->len+1, gf_common_mt_char);
+        if (!clnt_cmd) {
+                ret = -1;
+                goto out;
+        }
 
-        ret = dict_set_str (dict, CLIENT_CMD_CONNECT, dst_brick);
+        memcpy (clnt_cmd, data->data, data->len);
+        clnt_cmd[data->len] = '\0';
+        gf_log (this->name, GF_LOG_DEBUG, "Got destination brick %s\n",
+                        clnt_cmd);
+
+        ret = dict_set_dynstr (dict, CLIENT_CMD_CONNECT, clnt_cmd);
         if (ret < 0) {
                 gf_log (this->name, GF_LOG_ERROR,
                         "Could not inititiate destination brick "
@@ -942,8 +949,16 @@ pump_initiate_sink_connect (call_frame_t *frame, xlator_t *this)
 
         ret = 0;
 
-        dict_unref (dict);
 out:
+        if (dict)
+                dict_unref (dict);
+
+        if (data)
+                data_unref (data);
+
+        if (ret && clnt_cmd)
+                GF_FREE (clnt_cmd);
+
         return ret;
 }
 
@@ -1067,10 +1082,12 @@ pump_execute_status (call_frame_t *frame, xlator_t *this)
 
         dict = dict_new ();
 
-        ret = dict_set_str (dict, PUMP_CMD_STATUS, dict_str);
+        ret = dict_set_dynstr (dict, PUMP_CMD_STATUS, dict_str);
         if (ret < 0) {
                 gf_log (this->name, GF_LOG_DEBUG,
-                        "dict_set_str returned negative value");
+                        "dict_set_dynstr returned negative value");
+        } else {
+                dict_str = NULL;
         }
 
         op_ret = 0;
@@ -1079,8 +1096,11 @@ out:
 
         AFR_STACK_UNWIND (getxattr, frame, op_ret, op_errno, dict);
 
-        dict_unref (dict);
-        GF_FREE (dict_str);
+        if (dict)
+                dict_unref (dict);
+
+        if (dict_str)
+                GF_FREE (dict_str);
 
         return 0;
 }
@@ -2566,8 +2586,8 @@ init (xlator_t *this)
 	while (i < child_count) {
 		priv->children[i] = trav->xlator;
 
-                ret = asprintf (&priv->pending_key[i], "%s.%s", AFR_XATTR_PREFIX,
-                                trav->xlator->name);
+                ret = gf_asprintf (&priv->pending_key[i], "%s.%s", AFR_XATTR_PREFIX,
+                                   trav->xlator->name);
                 if (-1 == ret) {
                         gf_log (this->name, GF_LOG_ERROR,
                                 "asprintf failed to set pending key");