From 6c4096f5e6a6d0f2b21cb4b2bea098b6f4eebbed Mon Sep 17 00:00:00 2001 From: Prashanth Pai Date: Tue, 12 May 2015 16:36:55 +0530 Subject: libgfapi: Gracefully exit when glfd is invalid This is a backport of: http://review.gluster.org/10759 When glfs_* methods operating on glfd are invoked after calling glfs_close(), the program segfaults inside __GLFS_ENTRY_VALIDATE_FD trying to deference glfd->fd->inode which is invalid. Also, returning EBADF seemed more specific than EINVAL. BUG: 1240920 Change-Id: I13a92dca52da9a300252b69e026581b3a9e931fd Signed-off-by: Prashanth Pai Reviewed-on-master: http://review.gluster.org/10759 Tested-by: Gluster Build System Reviewed-by: Shyamsundar Ranganathan Reviewed-on: http://review.gluster.org/11571 Reviewed-by: Niels de Vos Reviewed-by: Humble Devassy Chirammal Reviewed-by: bipin kunal Tested-by: NetBSD Build System --- api/src/glfs-internal.h | 4 ++-- api/src/glfs.c | 6 ++++-- libglusterfs/src/fd.c | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/api/src/glfs-internal.h b/api/src/glfs-internal.h index 5696a5bdcd6..1c308dfb0dc 100644 --- a/api/src/glfs-internal.h +++ b/api/src/glfs-internal.h @@ -267,8 +267,8 @@ do { \ #define __GLFS_ENTRY_VALIDATE_FD(glfd, label) \ do { \ - if (!glfd) { \ - errno = EINVAL; \ + if (!glfd || !glfd->fd || !glfd->fd->inode) { \ + errno = EBADF; \ goto label; \ } \ old_THIS = THIS; \ diff --git a/api/src/glfs.c b/api/src/glfs.c index 5653f4d46c0..b3a3f9751dd 100644 --- a/api/src/glfs.c +++ b/api/src/glfs.c @@ -560,8 +560,10 @@ glfs_fd_destroy (struct glfs_fd *glfd) } glfs_unlock (glfd->fs); - if (glfd->fd) - fd_unref (glfd->fd); + if (glfd->fd) { + fd_unref (glfd->fd); + glfd->fd = NULL; + } GF_FREE (glfd->readdirbuf); diff --git a/libglusterfs/src/fd.c b/libglusterfs/src/fd.c index ea74d03b0a9..25cea496d73 100644 --- a/libglusterfs/src/fd.c +++ b/libglusterfs/src/fd.c @@ -537,7 +537,7 @@ fd_destroy (fd_t *fd) } UNLOCK (&fd->inode->lock); inode_unref (fd->inode); - fd->inode = (inode_t *)0xaaaaaaaa; + fd->inode = NULL; fd_lk_ctx_unref (fd->lk_ctx); mem_put (fd); out: -- cgit