posix-acl: Fix crash resulting from GF_FREE() done on a CALLOC'd object

The object in question was created in posix_acl_inherit () and
was being GF_FREE'd as part of data_destroy().

Change-Id: Ibdb7c3b5c10ce447f061bde68452502e5170de92
BUG: 1035751
Signed-off-by: Krutika Dhananjay <kdhananj@redhat.com>
Reviewed-on: http://review.gluster.org/6377
Reviewed-by: Pranith Kumar Karampuri <pkarampu@redhat.com>
Tested-by: Gluster Build System <jenkins@build.gluster.com>
Reviewed-by: Vijay Bellur <vbellur@redhat.com>

1 files changed, 28 insertions, 7 deletions

diff --git a/xlators/system/posix-acl/src/posix-acl.c b/xlators/system/posix-acl/src/posix-acl.c
index 4658cad49d1..947c71c7707 100644
--- a/xlators/system/posix-acl/src/posix-acl.c
+++ b/xlators/system/posix-acl/src/posix-acl.c
@@ -15,12 +15,32 @@
 
 #include "posix-acl.h"
 #include "posix-acl-xattr.h"
+#include "posix-acl-mem-types.h"
 
 
 #define UINT64(ptr) ((uint64_t)((long)(ptr)))
 #define PTR(num) ((void *)((long)(num)))
 
 
+int32_t
+mem_acct_init (xlator_t *this)
+{
+        int     ret = -1;
+
+        if (!this)
+                return ret;
+
+        ret = xlator_mem_acct_init (this, gf_posix_acl_mt_end + 1);
+
+        if (ret != 0) {
+                gf_log(this->name, GF_LOG_ERROR, "Memory accounting init"
+                       "failed");
+                return ret;
+        }
+
+        return ret;
+}
+
 static uid_t
 r00t ()
 {
@@ -277,7 +297,7 @@ posix_acl_ctx_get (inode_t *inode, xlator_t *this)
         if ((ret == 0) && (int_ctx))
                 return PTR(int_ctx);
 
-        ctx = CALLOC (1, sizeof (*ctx));
+        ctx = GF_CALLOC (1, sizeof (*ctx), gf_posix_acl_mt_ctx_t);
         if (!ctx)
                 return NULL;
 
@@ -333,7 +353,8 @@ posix_acl_new (xlator_t *this, int entrycnt)
         struct posix_acl *acl = NULL;
         struct posix_ace *ace = NULL;
 
-        acl = CALLOC (1, sizeof (*acl) + (entrycnt * sizeof (*ace)));
+        acl = GF_CALLOC (1, sizeof (*acl) + (entrycnt * sizeof (*ace)),
+                         gf_posix_acl_mt_posix_ace_t);
         if (!acl)
                 return NULL;
 
@@ -348,7 +369,7 @@ posix_acl_new (xlator_t *this, int entrycnt)
 void
 posix_acl_destroy (xlator_t *this, struct posix_acl *acl)
 {
-        FREE (acl);
+       GF_FREE (acl);
 
         return;
 }
@@ -577,7 +598,7 @@ posix_acl_inherit (xlator_t *this, loc_t *loc, dict_t *params, mode_t mode,
         ctx->perm = retmode;
 
         size_access = posix_acl_to_xattr (this, acl_access, NULL, 0);
-        xattr_access = CALLOC (1, size_access);
+        xattr_access = GF_CALLOC (1, size_access, gf_posix_acl_mt_char);
         if (!xattr_access) {
                 gf_log (this->name, GF_LOG_ERROR, "out of memory");
                 ret = -1;
@@ -600,7 +621,7 @@ posix_acl_inherit (xlator_t *this, loc_t *loc, dict_t *params, mode_t mode,
         acl_default = posix_acl_ref (this, par_default);
 
         size_default = posix_acl_to_xattr (this, acl_default, NULL, 0);
-        xattr_default = CALLOC (1, size_default);
+        xattr_default = GF_CALLOC (1, size_default, gf_posix_acl_mt_char);
         if (!xattr_default) {
                 gf_log (this->name, GF_LOG_ERROR, "out of memory");
                 ret = -1;
@@ -2050,7 +2071,7 @@ posix_acl_forget (xlator_t *this, inode_t *inode)
         if (ctx->acl_default)
                 posix_acl_unref (this, ctx->acl_default);
 
-        FREE (ctx);
+        GF_FREE (ctx);
 out:
         return 0;
 }
@@ -2078,7 +2099,7 @@ init (xlator_t *this)
         struct posix_acl        *minacl = NULL;
         struct posix_ace        *minace = NULL;
 
-        conf = CALLOC (1, sizeof (*conf));
+        conf = GF_CALLOC (1, sizeof (*conf), gf_posix_acl_mt_conf_t);
         if (!conf) {
                 gf_log (this->name, GF_LOG_ERROR,
                         "out of memory");