From ef105a25b021bb8be5d2cbeae868da9d9288e77a Mon Sep 17 00:00:00 2001 From: Raghavendra G Date: Tue, 4 May 2010 02:27:04 +0000 Subject: performance/read-ahead: don't set ra_file in fd->ctx unless all memebers of ra_file is initialized - If ptr to ra_file is set in fd->ctx even before initializing all its members, A race condition may occur b/w a thread executing ra_fstat, ra_readv etc (where all files open on the same inode are flushed) and the thread doing initialization of ra_file (in ra_open_cbk or ra_create_cbk). Because of this race-condition, flush_region might be called on an uninitialized ra_file, thereby causing crash. Signed-off-by: Raghavendra G Signed-off-by: Anand V. Avati BUG: 868 (crash in ra_fstat) URL: http://bugs.gluster.com/cgi-bin/bugzilla3/show_bug.cgi?id=868 --- xlators/performance/read-ahead/src/read-ahead.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/xlators/performance/read-ahead/src/read-ahead.c b/xlators/performance/read-ahead/src/read-ahead.c index 1b37cac..2ffb4ad 100644 --- a/xlators/performance/read-ahead/src/read-ahead.c +++ b/xlators/performance/read-ahead/src/read-ahead.c @@ -64,7 +64,6 @@ ra_open_cbk (call_frame_t *frame, void *cookie, xlator_t *this, goto unwind; } - ret = fd_ctx_set (fd, this, (uint64_t)(long)file); /* If mandatory locking has been enabled on this file, we disable caching on it */ @@ -102,6 +101,12 @@ ra_open_cbk (call_frame_t *frame, void *cookie, xlator_t *this, file->page_count = 1; } + ret = fd_ctx_set (fd, this, (uint64_t)(long)file); + if (ret == -1) { + ra_file_destroy (file); + op_ret = -1; + op_errno = ENOMEM; + } unwind: STACK_UNWIND (frame, op_ret, op_errno, fd); @@ -133,8 +138,6 @@ ra_create_cbk (call_frame_t *frame, void *cookie, xlator_t *this, goto unwind; } - ret = fd_ctx_set (fd, this, (uint64_t)(long)file); - /* If mandatory locking has been enabled on this file, we disable caching on it */ @@ -168,6 +171,13 @@ ra_create_cbk (call_frame_t *frame, void *cookie, xlator_t *this, file->page_size = conf->page_size; pthread_mutex_init (&file->file_lock, NULL); + ret = fd_ctx_set (fd, this, (uint64_t)(long)file); + if (ret == -1) { + ra_file_destroy (file); + op_ret = -1; + op_errno = ENOMEM; + } + unwind: STACK_UNWIND (frame, op_ret, op_errno, fd, inode, buf); -- cgit v1.1