summaryrefslogtreecommitdiffstats
path: root/xlators/mgmt
diff options
context:
space:
mode:
authorMohammed Rafi KC <rkavunga@redhat.com>2016-03-30 17:42:44 +0530
committerJeff Darcy <jdarcy@redhat.com>2016-03-31 10:16:50 -0700
commit8dfbb6751b2f421fb179ecf6abf803fbe983350e (patch)
treef8d0a1252c553e1b4820131107231b9a2c69a861 /xlators/mgmt
parentb4cbfdac0d35e6896f337b4ae7b75dcf4e714a1a (diff)
glusterd/syncop: double free of frame stack
If rpc message from glusterd during brick op phase fails without sending, then frame was freed from the caller function and call back function. Change-Id: I63cb3be30074e9a074f6895faa25b3d091f5b6a5 BUG: 1322262 Signed-off-by: Mohammed Rafi KC <rkavunga@redhat.com> Reviewed-on: http://review.gluster.org/13854 Smoke: Gluster Build System <jenkins@build.gluster.com> NetBSD-regression: NetBSD Build System <jenkins@build.gluster.org> CentOS-regression: Gluster Build System <jenkins@build.gluster.com> Reviewed-by: Jeff Darcy <jdarcy@redhat.com>
Diffstat (limited to 'xlators/mgmt')
-rw-r--r--xlators/mgmt/glusterd/src/glusterd-mgmt.c41
-rw-r--r--xlators/mgmt/glusterd/src/glusterd-syncop.c48
2 files changed, 65 insertions, 24 deletions
diff --git a/xlators/mgmt/glusterd/src/glusterd-mgmt.c b/xlators/mgmt/glusterd/src/glusterd-mgmt.c
index 575fb6fe1fe..c83e31ea8ed 100644
--- a/xlators/mgmt/glusterd/src/glusterd-mgmt.c
+++ b/xlators/mgmt/glusterd/src/glusterd-mgmt.c
@@ -480,7 +480,11 @@ out:
if (rsp.dict.dict_val)
free (rsp.dict.dict_val);
- STACK_DESTROY (frame->root);
+ /* req->rpc_status set to -1 means, STACK_DESTROY will be called from
+ * the caller function.
+ */
+ if (req->rpc_status != -1)
+ STACK_DESTROY (frame->root);
synctask_barrier_wake(args);
return 0;
}
@@ -780,8 +784,11 @@ out:
if (rsp.op_errstr)
free (rsp.op_errstr);
GF_FREE (peerid);
-
- STACK_DESTROY (frame->root);
+ /* req->rpc_status set to -1 means, STACK_DESTROY will be called from
+ * the caller function.
+ */
+ if (req->rpc_status != -1)
+ STACK_DESTROY (frame->root);
synctask_barrier_wake(args);
return 0;
}
@@ -1068,8 +1075,11 @@ out:
if (rsp.dict.dict_val)
free (rsp.dict.dict_val);
GF_FREE (peerid);
-
- STACK_DESTROY (frame->root);
+ /* req->rpc_status set to -1 means, STACK_DESTROY will be called from
+ * the caller function.
+ */
+ if (req->rpc_status != -1)
+ STACK_DESTROY (frame->root);
synctask_barrier_wake(args);
return 0;
}
@@ -1314,8 +1324,11 @@ out:
gd_mgmt_v3_collate_errors (args, op_ret, op_errno, rsp.op_errstr,
GLUSTERD_MGMT_V3_COMMIT, *peerid, rsp.uuid);
GF_FREE (peerid);
-
- STACK_DESTROY (frame->root);
+ /* req->rpc_status set to -1 means, STACK_DESTROY will be called from
+ * the caller function.
+ */
+ if (req->rpc_status != -1)
+ STACK_DESTROY (frame->root);
synctask_barrier_wake(args);
return 0;
}
@@ -1542,8 +1555,11 @@ out:
if (rsp.dict.dict_val)
free (rsp.dict.dict_val);
GF_FREE (peerid);
-
- STACK_DESTROY (frame->root);
+ /* req->rpc_status set to -1 means, STACK_DESTROY will be called from
+ * the caller function.
+ */
+ if (req->rpc_status != -1)
+ STACK_DESTROY (frame->root);
synctask_barrier_wake(args);
return 0;
}
@@ -1758,8 +1774,11 @@ out:
if (rsp.dict.dict_val)
free (rsp.dict.dict_val);
GF_FREE (peerid);
-
- STACK_DESTROY (frame->root);
+ /* req->rpc_status set to -1 means, STACK_DESTROY will be called from
+ * the caller function.
+ */
+ if (req->rpc_status != -1)
+ STACK_DESTROY (frame->root);
synctask_barrier_wake(args);
return 0;
}
diff --git a/xlators/mgmt/glusterd/src/glusterd-syncop.c b/xlators/mgmt/glusterd/src/glusterd-syncop.c
index bb385d4775d..f798c9fc96d 100644
--- a/xlators/mgmt/glusterd/src/glusterd-syncop.c
+++ b/xlators/mgmt/glusterd/src/glusterd-syncop.c
@@ -363,8 +363,11 @@ out:
GLUSTERD_MGMT_V3_LOCK, *peerid, rsp.uuid);
GF_FREE (peerid);
-
- STACK_DESTROY (frame->root);
+ /* req->rpc_status set to -1 means, STACK_DESTROY will be called from
+ * the caller function.
+ */
+ if (req->rpc_status != -1)
+ STACK_DESTROY (frame->root);
synctask_barrier_wake(args);
return 0;
}
@@ -465,8 +468,11 @@ out:
GLUSTERD_MGMT_V3_UNLOCK, *peerid, rsp.uuid);
GF_FREE (peerid);
-
- STACK_DESTROY (frame->root);
+ /* req->rpc_status set to -1 means, STACK_DESTROY will be called from
+ * the caller function.
+ */
+ if (req->rpc_status != -1)
+ STACK_DESTROY (frame->root);
synctask_barrier_wake(args);
return 0;
}
@@ -578,8 +584,11 @@ out:
GLUSTERD_MGMT_CLUSTER_LOCK, *peerid, rsp.uuid);
GF_FREE (peerid);
-
- STACK_DESTROY (frame->root);
+ /* req->rpc_status set to -1 means, STACK_DESTROY will be called from
+ * the caller function.
+ */
+ if (req->rpc_status != -1)
+ STACK_DESTROY (frame->root);
synctask_barrier_wake(args);
return 0;
}
@@ -672,8 +681,11 @@ out:
GLUSTERD_MGMT_CLUSTER_UNLOCK, *peerid, rsp.uuid);
GF_FREE (peerid);
-
- STACK_DESTROY (frame->root);
+ /* req->rpc_status set to -1 means, STACK_DESTROY will be called from
+ * the caller function.
+ */
+ if (req->rpc_status != -1)
+ STACK_DESTROY (frame->root);
synctask_barrier_wake(args);
return 0;
}
@@ -801,8 +813,11 @@ out:
if (rsp_dict)
dict_unref (rsp_dict);
GF_FREE (peerid);
-
- STACK_DESTROY (frame->root);
+ /* req->rpc_status set to -1 means, STACK_DESTROY will be called from
+ * the caller function.
+ */
+ if (req->rpc_status != -1)
+ STACK_DESTROY (frame->root);
synctask_barrier_wake(args);
return 0;
}
@@ -910,7 +925,11 @@ out:
free (rsp.op_errstr);
free (rsp.output.output_val);
- STACK_DESTROY (frame->root);
+ /* req->rpc_status set to -1 means, STACK_DESTROY will be called from
+ * the caller function.
+ */
+ if (req->rpc_status != -1)
+ STACK_DESTROY (frame->root);
__wake (args);
return 0;
@@ -1087,8 +1106,11 @@ out:
if (rsp_dict)
dict_unref (rsp_dict);
GF_FREE (peerid);
-
- STACK_DESTROY (frame->root);
+ /* req->rpc_status set to -1 means, STACK_DESTROY will be called from
+ * the caller function.
+ */
+ if (req->rpc_status != -1)
+ STACK_DESTROY (frame->root);
synctask_barrier_wake(args);
return 0;