[Gluster-devel] NetBSD regressions, memory corruption

[Emmanuel Dreyfus]

On Thu, Mar 26, 2015 at 02:00:19PM +0000, Emmanuel Dreyfus wrote:
> changelog_rpc_poller() contains a call to event_dispatch(). Here we have
> our difference between NetBSD and Linux: the former uses poll, while the
> later uses epoll. 

In event_dispatch_poll() I think there is a race condition:
event_pool->destroy can be set after the test, and we can
enter event_dispatch_poll_resize with the flag set:

                pthread_mutex_lock (&event_pool->mutex);
                {
                        if (event_pool->destroy == 1) {
                                event_pool->activethreadcount = 0;
                                pthread_cond_broadcast (&event_pool->cond);
                                pthread_mutex_unlock (&event_pool->mutex);
                                return 0;
                        }
                }
                pthread_mutex_unlock (&event_pool->mutex);
         
                size = event_dispatch_poll_resize (event_pool, ufds, size);

event_dispatch_poll_resize() performs allocations on pointers that may
be dandling. One solution could be to move it inside event_pool->mutex
critical section.

I will try this on nbslave70.

-- 
Emmanuel Dreyfus
manu at netbsd.org