path: root/rpc
diff options
authorKrutika Dhananjay <>2016-10-17 15:13:28 +0530
committerAtin Mukherjee <>2016-10-24 07:11:08 -0700
commit41dc5ee07ffba6d17459757abf13fae9f174e6b6 (patch)
tree0cc0f68eb02c63300b2e1838ee39152af253ebe5 /rpc
parentf31b3213e2a97259faa7dcae2354d2535732068b (diff)
compound fops: Fix file corruption issue
1. Address of a local variable @args is copied into state->req in server3_3_compound (). But even after the function has gone out of scope, in server_compound_resume () this pointer is accessed and dereferenced. This patch fixes that. 2. Compound fops, by virtue of NOT having a vector sizer (like the one writev has), ends up having both the header and the data (in case one of its member fops is WRITEV) in the same hdr_iobuf. This buffer was not being preserved through the lifetime of the compound fop, causing it to be overwritten by a parallel write fop, even when the writev associated with the currently executing compound fop is yet to hit the desk, thereby corrupting the file's data. This is fixed by associating the hdr_iobuf with the iobref so its memory remains valid through the lifetime of the fop. 3. Also fixed a use-after-free bug in protocol/client in compound fops cbk, missed by Linux but caught by NetBSD. Finally, big thanks to Pranith Kumar K and Raghavendra Gowdappa for their help in debugging this file corruption issue. Change-Id: I6d5c04f400ecb687c9403a17a12683a96c2bf122 BUG: 1378778 Signed-off-by: Krutika Dhananjay <> Reviewed-on: NetBSD-regression: NetBSD Build System <> Reviewed-by: Raghavendra G <> Smoke: Gluster Build System <> CentOS-regression: Gluster Build System <>
Diffstat (limited to 'rpc')
4 files changed, 1 insertions, 15 deletions
diff --git a/rpc/rpc-lib/src/rpc-transport.c b/rpc/rpc-lib/src/rpc-transport.c
index 005b68c..6ee5e15 100644
--- a/rpc/rpc-lib/src/rpc-transport.c
+++ b/rpc/rpc-lib/src/rpc-transport.c
@@ -123,10 +123,6 @@ rpc_transport_pollin_destroy (rpc_transport_pollin_t *pollin)
iobref_unref (pollin->iobref);
- if (pollin->hdr_iobuf) {
- iobuf_unref (pollin->hdr_iobuf);
- }
if (pollin->private) {
/* */
GF_FREE (pollin->private);
@@ -158,7 +154,7 @@ rpc_transport_pollin_alloc (rpc_transport_t *this, struct iovec *vector,
msg->iobref = iobref_ref (iobref);
msg->private = private;
if (hdr_iobuf)
- msg->hdr_iobuf = iobuf_ref (hdr_iobuf);
+ iobref_add (iobref, hdr_iobuf);
return msg;
diff --git a/rpc/rpc-lib/src/rpc-transport.h b/rpc/rpc-lib/src/rpc-transport.h
index f0add06..4e7a8c4 100644
--- a/rpc/rpc-lib/src/rpc-transport.h
+++ b/rpc/rpc-lib/src/rpc-transport.h
@@ -163,7 +163,6 @@ struct rpc_transport_pollin {
char vectored;
void *private;
struct iobref *iobref;
- struct iobuf *hdr_iobuf;
char is_reply;
typedef struct rpc_transport_pollin rpc_transport_pollin_t;
diff --git a/rpc/rpc-lib/src/rpcsvc.c b/rpc/rpc-lib/src/rpcsvc.c
index f07e745..c792909 100644
--- a/rpc/rpc-lib/src/rpcsvc.c
+++ b/rpc/rpc-lib/src/rpcsvc.c
@@ -373,9 +373,6 @@ rpcsvc_request_destroy (rpcsvc_request_t *req)
iobref_unref (req->iobref);
- if (req->hdr_iobuf)
- iobuf_unref (req->hdr_iobuf);
/* This marks the "end" of an RPC request. Reply is
completely written to the socket and is on the way
to the client. It is time to decrement the
@@ -690,9 +687,6 @@ rpcsvc_handle_rpc_call (rpcsvc_t *svc, rpc_transport_t *trans,
if (req->synctask) {
- if (msg->hdr_iobuf)
- req->hdr_iobuf = iobuf_ref (msg->hdr_iobuf);
ret = synctask_new (THIS->ctx->env,
(synctask_fn_t) actor_fn,
rpcsvc_check_and_reply_error, NULL,
diff --git a/rpc/rpc-lib/src/rpcsvc.h b/rpc/rpc-lib/src/rpcsvc.h
index 02e467e..63a6dad 100644
--- a/rpc/rpc-lib/src/rpcsvc.h
+++ b/rpc/rpc-lib/src/rpcsvc.h
@@ -244,9 +244,6 @@ struct rpcsvc_request {
/* Container for transport to store request-specific item */
void *trans_private;
- /* we need to ref the 'iobuf' in case of 'synctasking' it */
- struct iobuf *hdr_iobuf;
/* pointer to cached reply for use in DRC */
drc_cached_op_t *reply;