diff options
| author | Mohammed Rafi KC <rkavunga@redhat.com> | 2016-03-30 17:42:44 +0530 |
|---|---|---|
| committer | Jeff Darcy <jdarcy@redhat.com> | 2016-03-31 10:16:50 -0700 |
| commit | 8dfbb6751b2f421fb179ecf6abf803fbe983350e (patch) | |
| tree | f8d0a1252c553e1b4820131107231b9a2c69a861 /xlators/mgmt | |
| parent | b4cbfdac0d35e6896f337b4ae7b75dcf4e714a1a (diff) | |
glusterd/syncop: double free of frame stack
If rpc message from glusterd during brick op phase
fails without sending, then frame was freed from
the caller function and call back function.
Change-Id: I63cb3be30074e9a074f6895faa25b3d091f5b6a5
BUG: 1322262
Signed-off-by: Mohammed Rafi KC <rkavunga@redhat.com>
Reviewed-on: http://review.gluster.org/13854
Smoke: Gluster Build System <jenkins@build.gluster.com>
NetBSD-regression: NetBSD Build System <jenkins@build.gluster.org>
CentOS-regression: Gluster Build System <jenkins@build.gluster.com>
Reviewed-by: Jeff Darcy <jdarcy@redhat.com>
Diffstat (limited to 'xlators/mgmt')
| -rw-r--r-- | xlators/mgmt/glusterd/src/glusterd-mgmt.c | 41 | ||||
| -rw-r--r-- | xlators/mgmt/glusterd/src/glusterd-syncop.c | 48 |
2 files changed, 65 insertions, 24 deletions
diff --git a/xlators/mgmt/glusterd/src/glusterd-mgmt.c b/xlators/mgmt/glusterd/src/glusterd-mgmt.c index 575fb6fe1fe..c83e31ea8ed 100644 --- a/xlators/mgmt/glusterd/src/glusterd-mgmt.c +++ b/xlators/mgmt/glusterd/src/glusterd-mgmt.c @@ -480,7 +480,11 @@ out: if (rsp.dict.dict_val) free (rsp.dict.dict_val); - STACK_DESTROY (frame->root); + /* req->rpc_status set to -1 means, STACK_DESTROY will be called from + * the caller function. + */ + if (req->rpc_status != -1) + STACK_DESTROY (frame->root); synctask_barrier_wake(args); return 0; } @@ -780,8 +784,11 @@ out: if (rsp.op_errstr) free (rsp.op_errstr); GF_FREE (peerid); - - STACK_DESTROY (frame->root); + /* req->rpc_status set to -1 means, STACK_DESTROY will be called from + * the caller function. + */ + if (req->rpc_status != -1) + STACK_DESTROY (frame->root); synctask_barrier_wake(args); return 0; } @@ -1068,8 +1075,11 @@ out: if (rsp.dict.dict_val) free (rsp.dict.dict_val); GF_FREE (peerid); - - STACK_DESTROY (frame->root); + /* req->rpc_status set to -1 means, STACK_DESTROY will be called from + * the caller function. + */ + if (req->rpc_status != -1) + STACK_DESTROY (frame->root); synctask_barrier_wake(args); return 0; } @@ -1314,8 +1324,11 @@ out: gd_mgmt_v3_collate_errors (args, op_ret, op_errno, rsp.op_errstr, GLUSTERD_MGMT_V3_COMMIT, *peerid, rsp.uuid); GF_FREE (peerid); - - STACK_DESTROY (frame->root); + /* req->rpc_status set to -1 means, STACK_DESTROY will be called from + * the caller function. + */ + if (req->rpc_status != -1) + STACK_DESTROY (frame->root); synctask_barrier_wake(args); return 0; } @@ -1542,8 +1555,11 @@ out: if (rsp.dict.dict_val) free (rsp.dict.dict_val); GF_FREE (peerid); - - STACK_DESTROY (frame->root); + /* req->rpc_status set to -1 means, STACK_DESTROY will be called from + * the caller function. + */ + if (req->rpc_status != -1) + STACK_DESTROY (frame->root); synctask_barrier_wake(args); return 0; } @@ -1758,8 +1774,11 @@ out: if (rsp.dict.dict_val) free (rsp.dict.dict_val); GF_FREE (peerid); - - STACK_DESTROY (frame->root); + /* req->rpc_status set to -1 means, STACK_DESTROY will be called from + * the caller function. + */ + if (req->rpc_status != -1) + STACK_DESTROY (frame->root); synctask_barrier_wake(args); return 0; } diff --git a/xlators/mgmt/glusterd/src/glusterd-syncop.c b/xlators/mgmt/glusterd/src/glusterd-syncop.c index bb385d4775d..f798c9fc96d 100644 --- a/xlators/mgmt/glusterd/src/glusterd-syncop.c +++ b/xlators/mgmt/glusterd/src/glusterd-syncop.c @@ -363,8 +363,11 @@ out: GLUSTERD_MGMT_V3_LOCK, *peerid, rsp.uuid); GF_FREE (peerid); - - STACK_DESTROY (frame->root); + /* req->rpc_status set to -1 means, STACK_DESTROY will be called from + * the caller function. + */ + if (req->rpc_status != -1) + STACK_DESTROY (frame->root); synctask_barrier_wake(args); return 0; } @@ -465,8 +468,11 @@ out: GLUSTERD_MGMT_V3_UNLOCK, *peerid, rsp.uuid); GF_FREE (peerid); - - STACK_DESTROY (frame->root); + /* req->rpc_status set to -1 means, STACK_DESTROY will be called from + * the caller function. + */ + if (req->rpc_status != -1) + STACK_DESTROY (frame->root); synctask_barrier_wake(args); return 0; } @@ -578,8 +584,11 @@ out: GLUSTERD_MGMT_CLUSTER_LOCK, *peerid, rsp.uuid); GF_FREE (peerid); - - STACK_DESTROY (frame->root); + /* req->rpc_status set to -1 means, STACK_DESTROY will be called from + * the caller function. + */ + if (req->rpc_status != -1) + STACK_DESTROY (frame->root); synctask_barrier_wake(args); return 0; } @@ -672,8 +681,11 @@ out: GLUSTERD_MGMT_CLUSTER_UNLOCK, *peerid, rsp.uuid); GF_FREE (peerid); - - STACK_DESTROY (frame->root); + /* req->rpc_status set to -1 means, STACK_DESTROY will be called from + * the caller function. + */ + if (req->rpc_status != -1) + STACK_DESTROY (frame->root); synctask_barrier_wake(args); return 0; } @@ -801,8 +813,11 @@ out: if (rsp_dict) dict_unref (rsp_dict); GF_FREE (peerid); - - STACK_DESTROY (frame->root); + /* req->rpc_status set to -1 means, STACK_DESTROY will be called from + * the caller function. + */ + if (req->rpc_status != -1) + STACK_DESTROY (frame->root); synctask_barrier_wake(args); return 0; } @@ -910,7 +925,11 @@ out: free (rsp.op_errstr); free (rsp.output.output_val); - STACK_DESTROY (frame->root); + /* req->rpc_status set to -1 means, STACK_DESTROY will be called from + * the caller function. + */ + if (req->rpc_status != -1) + STACK_DESTROY (frame->root); __wake (args); return 0; @@ -1087,8 +1106,11 @@ out: if (rsp_dict) dict_unref (rsp_dict); GF_FREE (peerid); - - STACK_DESTROY (frame->root); + /* req->rpc_status set to -1 means, STACK_DESTROY will be called from + * the caller function. + */ + if (req->rpc_status != -1) + STACK_DESTROY (frame->root); synctask_barrier_wake(args); return 0; |