summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPranith Kumar K <pkarampu@redhat.com>2015-11-26 09:58:39 +0530
committerVenky Shankar <vshankar@redhat.com>2015-11-26 20:04:16 -0800
commita1919e91279a6c691fbd3dd6c0d97e74e78ccf22 (patch)
tree42c00762fa39f3b42e98b13e7cc5683a5b821531
parent0db6d57a184ed79eb3142c42957b1a2415744011 (diff)
features/bit-rot: Fix NULL dereference
Problem: By the time br_stub_worker is accessing this->private in it's thread, 'init' may not have set 'this->private = priv'. This leads to NULL dereference leading to brick crash. Fix: Set this->private before launching these threads. Change-Id: Ic797eb195fdd0c70d19f28d0b97bc0181fd3dd2f BUG: 1285616 Signed-off-by: Pranith Kumar K <pkarampu@redhat.com> Reviewed-on: http://review.gluster.org/12754 Tested-by: Gluster Build System <jenkins@build.gluster.com> Tested-by: NetBSD Build System <jenkins@build.gluster.org> Reviewed-by: Venky Shankar <vshankar@redhat.com>
-rw-r--r--xlators/features/bit-rot/src/stub/bit-rot-stub.c14
1 files changed, 10 insertions, 4 deletions
diff --git a/xlators/features/bit-rot/src/stub/bit-rot-stub.c b/xlators/features/bit-rot/src/stub/bit-rot-stub.c
index 83a7860..27a5ff7 100644
--- a/xlators/features/bit-rot/src/stub/bit-rot-stub.c
+++ b/xlators/features/bit-rot/src/stub/bit-rot-stub.c
@@ -154,7 +154,12 @@ init (xlator_t *this)
pthread_cond_init (&priv->cond, NULL);
INIT_LIST_HEAD (&priv->squeue);
- ret = gf_thread_create (&priv->signth, NULL, br_stub_signth, priv);
+ /* Thread creations need 'this' to be passed so that THIS can be
+ * assigned inside the thread. So setting this->private here.
+ */
+ this->private = priv;
+
+ ret = gf_thread_create (&priv->signth, NULL, br_stub_signth, this);
if (ret != 0)
goto cleanup_lock;
@@ -165,8 +170,6 @@ init (xlator_t *this)
goto cleanup_lock;
}
- this->private = priv;
-
gf_msg_debug (this->name, 0, "bit-rot stub loaded");
return 0;
@@ -178,6 +181,7 @@ init (xlator_t *this)
mem_pool_destroy (priv->local_pool);
free_priv:
GF_FREE (priv);
+ this->private = NULL;
error_return:
return -1;
}
@@ -758,9 +762,11 @@ br_stub_perform_objsign (call_frame_t *frame, xlator_t *this,
void *
br_stub_signth (void *arg)
{
- br_stub_private_t *priv = arg;
+ xlator_t *this = arg;
+ br_stub_private_t *priv = this->private;
struct br_stub_signentry *sigstub = NULL;
+ THIS = this;
while (1) {
pthread_mutex_lock (&priv->lock);
{