graph/shd: Use top down approach while cleaning xlator

We were cleaning xlator from botton to top, which might
lead to problems when upper xlators trying to access
the xlator object loaded below.

One such scenario is when fd_unref happens as part of the
fini call which might lead to calling the releasedir to
lower xlator. This will lead to invalid mem access

Change-Id: I8a6cb619256fab0b0c01a2d564fc88287c4415a0
Updates: bz#1716695
Signed-off-by: Mohammed Rafi KC <rkavunga@redhat.com>

10 files changed, 21 insertions, 2 deletions

diff --git a/libglusterfs/src/graph.c b/libglusterfs/src/graph.c
index aea74a5edad..0b99e618191 100644
--- a/libglusterfs/src/graph.c
+++ b/libglusterfs/src/graph.c
@@ -1200,6 +1200,14 @@ glusterfs_graph_fini(glusterfs_graph_t *graph)
         if (trav->init_succeeded) {
             trav->cleanup_starting = 1;
             trav->fini(trav);
+            if (trav->local_pool) {
+                mem_pool_destroy(trav->local_pool);
+                trav->local_pool = NULL;
+            }
+            if (trav->itable) {
+                inode_table_destroy(trav->itable);
+                trav->itable = NULL;
+            }
             trav->init_succeeded = 0;
         }
         trav = trav->next;
@@ -1401,7 +1409,7 @@ glusterfs_graph_cleanup(void *arg)
 
     pthread_mutex_lock(&ctx->cleanup_lock);
     {
-        glusterfs_graph_deactivate(graph);
+        glusterfs_graph_fini(graph);
         glusterfs_graph_destroy(graph);
     }
     pthread_mutex_unlock(&ctx->cleanup_lock);
diff --git a/xlators/features/bit-rot/src/stub/bit-rot-stub.c b/xlators/features/bit-rot/src/stub/bit-rot-stub.c
index e6d64de99a9..de2184d6193 100644
--- a/xlators/features/bit-rot/src/stub/bit-rot-stub.c
+++ b/xlators/features/bit-rot/src/stub/bit-rot-stub.c
@@ -196,6 +196,7 @@ cleanup_lock:
     pthread_mutex_destroy(&priv->lock);
 free_mempool:
     mem_pool_destroy(priv->local_pool);
+    priv->local_pool = NULL;
 free_priv:
     GF_FREE(priv);
     this->private = NULL;
diff --git a/xlators/features/changelog/src/changelog.c b/xlators/features/changelog/src/changelog.c
index d9025f344c7..2862d1e2c34 100644
--- a/xlators/features/changelog/src/changelog.c
+++ b/xlators/features/changelog/src/changelog.c
@@ -2790,6 +2790,7 @@ cleanup_options:
     changelog_freeup_options(this, priv);
 cleanup_mempool:
     mem_pool_destroy(this->local_pool);
+    this->local_pool = NULL;
 cleanup_priv:
     GF_FREE(priv);
 error_return:
diff --git a/xlators/features/cloudsync/src/cloudsync.c b/xlators/features/cloudsync/src/cloudsync.c
index 26e512c3af1..0ad987ecf5f 100644
--- a/xlators/features/cloudsync/src/cloudsync.c
+++ b/xlators/features/cloudsync/src/cloudsync.c
@@ -200,8 +200,10 @@ cs_init(xlator_t *this)
 
 out:
     if (ret == -1) {
-        if (this->local_pool)
+        if (this->local_pool) {
             mem_pool_destroy(this->local_pool);
+            this->local_pool = NULL;
+        }
 
         cs_cleanup_private(priv);
 
diff --git a/xlators/features/index/src/index.c b/xlators/features/index/src/index.c
index 2f2a6d04fb3..4ece7ff6fc8 100644
--- a/xlators/features/index/src/index.c
+++ b/xlators/features/index/src/index.c
@@ -2478,6 +2478,7 @@ out:
             GF_FREE(priv);
         this->private = NULL;
         mem_pool_destroy(this->local_pool);
+        this->local_pool = NULL;
     }
 
     if (attr_inited)
diff --git a/xlators/features/quiesce/src/quiesce.c b/xlators/features/quiesce/src/quiesce.c
index 218db9c921a..4b709f12fe9 100644
--- a/xlators/features/quiesce/src/quiesce.c
+++ b/xlators/features/quiesce/src/quiesce.c
@@ -2527,6 +2527,7 @@ fini(xlator_t *this)
     this->private = NULL;
 
     mem_pool_destroy(priv->local_pool);
+    priv->local_pool = NULL;
     LOCK_DESTROY(&priv->lock);
     GF_FREE(priv);
 out:
diff --git a/xlators/features/read-only/src/worm.c b/xlators/features/read-only/src/worm.c
index f59663802e6..48d62e0ed86 100644
--- a/xlators/features/read-only/src/worm.c
+++ b/xlators/features/read-only/src/worm.c
@@ -576,6 +576,7 @@ fini(xlator_t *this)
     mem_put(priv);
     this->private = NULL;
     mem_pool_destroy(this->local_pool);
+    this->local_pool = NULL;
 out:
     return;
 }
diff --git a/xlators/features/sdfs/src/sdfs.c b/xlators/features/sdfs/src/sdfs.c
index 3460b475824..aaf13f0852e 100644
--- a/xlators/features/sdfs/src/sdfs.c
+++ b/xlators/features/sdfs/src/sdfs.c
@@ -1436,6 +1436,7 @@ void
 fini(xlator_t *this)
 {
     mem_pool_destroy(this->local_pool);
+    this->local_pool = NULL;
     return;
 }
 
diff --git a/xlators/features/selinux/src/selinux.c b/xlators/features/selinux/src/selinux.c
index e8e16cde8c4..9b1b4b55e1a 100644
--- a/xlators/features/selinux/src/selinux.c
+++ b/xlators/features/selinux/src/selinux.c
@@ -252,6 +252,7 @@ out:
     if (ret) {
         GF_FREE(priv);
         mem_pool_destroy(this->local_pool);
+        this->local_pool = NULL;
     }
     return ret;
 }
@@ -280,6 +281,7 @@ fini(xlator_t *this)
     GF_FREE(priv);
 
     mem_pool_destroy(this->local_pool);
+    this->local_pool = NULL;
 
     return;
 }
diff --git a/xlators/features/trash/src/trash.c b/xlators/features/trash/src/trash.c
index f96ed73c10a..f44b11c6872 100644
--- a/xlators/features/trash/src/trash.c
+++ b/xlators/features/trash/src/trash.c
@@ -2523,6 +2523,7 @@ out:
             GF_FREE(priv);
         }
         mem_pool_destroy(this->local_pool);
+        this->local_pool = NULL;
     }
     return ret;
 }