[Bugs] [Bug 1422350] glustershd process crashed on systemic setup

[bugzilla at redhat.com]

https://bugzilla.redhat.com/show_bug.cgi?id=1422350



--- Comment #2 from Worker Ant <bugzilla-bot at gluster.org> ---
COMMIT: https://review.gluster.org/16619 committed in release-3.10 by
Shyamsundar Ranganathan (srangana at redhat.com) 
------
commit 5d8951afdc083008ad1d6f930291b36dca86c94f
Author: Ravishankar N <ravishankar at redhat.com>
Date:   Thu Feb 2 16:41:45 2017 +0530

    protocol/client: Fix double free of client fdctx destroy

    This patch fixes the race between fd re-open code and fd release code,
    both of which free the fd context due to a race in certain variable
    checks as explained below:

    1. client process (shd in the case of this BZ) sends an opendir to its
    children (client xlators) which send the fop to the bricks to get a valid
fd.

    2. Client xlator loses connection to the brick. fdctx->remotefd is -1

    3. Client re-establishes connection. After handshake, it reopens the dir
    and sets fdctx->remotefd to a valid fd in client3_3_reopendir_cbk().

    4. Meanwhile, shd sends a fd unref after it is done with the opendir.
    This triggers a releasedir (since fd->refcount becomes 0).

    5. client3_3_releasedir() sees that fdctx-->remotefd is a valid number
    (i.e not -1), sets fdctx->released=1 and calls  client_fdctx_destroy()

    6. As a continuation of step3, client_reopen_done() is called by
    client3_3_reopendir_cbk(), which sees that fdctx->released==1 and
    again calls client_fdctx_destroy().

    Depending on when step-5 does GF_FREE(fdctx), we may crash at any place in
    step-6 in client3_3_reopendir_cbk() when it tries to access
    fdctx->{whatever}.


    > Reviewed-on: https://review.gluster.org/16521
    > CentOS-regression: Gluster Build System <jenkins at build.gluster.org>
    > NetBSD-regression: NetBSD Build System <jenkins at build.gluster.org>
    > Smoke: Gluster Build System <jenkins at build.gluster.org>
    > Reviewed-by: Pranith Kumar Karampuri <pkarampu at redhat.com>

    (cherry picked from commit 25fc74f9d1f2b1e7bab76485a99f27abadd10b7b)
    Change-Id: Ia50873d11763e084e41d2a1f4d53715438e5e947
    BUG: 1422350
    Signed-off-by: Ravishankar N <ravishankar at redhat.com>
    Reviewed-on: https://review.gluster.org/16619
    Smoke: Gluster Build System <jenkins at build.gluster.org>
    NetBSD-regression: NetBSD Build System <jenkins at build.gluster.org>
    CentOS-regression: Gluster Build System <jenkins at build.gluster.org>
    Reviewed-by: Shyamsundar Ranganathan <srangana at redhat.com>

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=NyM97u29Sd&a=cc_unsubscribe