nfs/drc: Fix memory corruptions

* A wrong memory allocator was used to (de)allocate nodes (not data in
them) of rb tree. This patch uses default allocator, since that suits
our purpose.
* Fix reference counting of client, though hitting the codepath
containing this bug is highly unlikely.

Change-Id: I7692097351d6e54288fee01da5af18e761fd0e8c
Signed-off-by: Raghavendra G <rgowdapp@redhat.com>
BUG: 1067256
Reviewed-on: http://review.gluster.org/7816
Tested-by: Gluster Build System <jenkins@build.gluster.com>
Reviewed-by: Santosh Pradhan <spradhan@redhat.com>
Reviewed-by: Niels de Vos <ndevos@redhat.com>

1 files changed, 26 insertions, 24 deletions

diff --git a/rpc/rpc-lib/src/rpcsvc.c b/rpc/rpc-lib/src/rpcsvc.c
index 814af05f7b6..a10f182647f 100644
--- a/rpc/rpc-lib/src/rpcsvc.c
+++ b/rpc/rpc-lib/src/rpcsvc.c
@@ -624,30 +624,32 @@ rpcsvc_handle_rpc_call (rpcsvc_t *svc, rpc_transport_t *trans,
                 drc = req->svc->drc;
 
                 LOCK (&drc->lock);
-                reply = rpcsvc_drc_lookup (req);
-
-                /* retransmission of completed request, send cached reply */
-                if (reply && reply->state == DRC_OP_CACHED) {
-                        gf_log (GF_RPCSVC, GF_LOG_INFO, "duplicate request:"
-                                " XID: 0x%x", req->xid);
-                        ret = rpcsvc_send_cached_reply (req, reply);
-                        drc->cache_hits++;
-                        UNLOCK (&drc->lock);
-                        goto out;
-
-                } /* retransmitted request, original op in transit, drop it */
-                else if (reply && reply->state == DRC_OP_IN_TRANSIT) {
-                        gf_log (GF_RPCSVC, GF_LOG_INFO, "op in transit,"
-                                " discarding. XID: 0x%x", req->xid);
-                        ret = 0;
-                        drc->intransit_hits++;
-                        rpcsvc_request_destroy (req);
-                        UNLOCK (&drc->lock);
-                        goto out;
-
-                } /* fresh request, cache it as in-transit and proceed */
-                else {
-                        ret = rpcsvc_cache_request (req);
+                {
+                        reply = rpcsvc_drc_lookup (req);
+
+                        /* retransmission of completed request, send cached reply */
+                        if (reply && reply->state == DRC_OP_CACHED) {
+                                gf_log (GF_RPCSVC, GF_LOG_INFO, "duplicate request:"
+                                        " XID: 0x%x", req->xid);
+                                ret = rpcsvc_send_cached_reply (req, reply);
+                                drc->cache_hits++;
+                                UNLOCK (&drc->lock);
+                                goto out;
+
+                        } /* retransmitted request, original op in transit, drop it */
+                        else if (reply && reply->state == DRC_OP_IN_TRANSIT) {
+                                gf_log (GF_RPCSVC, GF_LOG_INFO, "op in transit,"
+                                        " discarding. XID: 0x%x", req->xid);
+                                ret = 0;
+                                drc->intransit_hits++;
+                                rpcsvc_request_destroy (req);
+                                UNLOCK (&drc->lock);
+                                goto out;
+
+                        } /* fresh request, cache it as in-transit and proceed */
+                        else {
+                                ret = rpcsvc_cache_request (req);
+                        }
                 }
                 UNLOCK (&drc->lock);
         }