From 8607f22dcd1bc9b84e452ae90102fa9d345ad3db Mon Sep 17 00:00:00 2001 From: Poornima G Date: Tue, 14 Feb 2017 12:45:36 +0530 Subject: rpcsvc: Add rpchdr and proghdr to iobref before submitting to transport Issue: When fio is run on multiple clients (each client writes to its own files), and meanwhile the clients does a readdirp, thus the client which did a readdirp will now recieve the upcalls. In this scenario the client disconnects with rpc decode failed error. RCA: Upcall calls rpcsvc_request_submit to submit the request to socket: rpcsvc_request_submit currently: rpcsvc_request_submit () { iobuf = iobuf_new iov = iobuf->ptr fill iobuf to contain xdrised upcall content - proghdr rpcsvc_callback_submit (..iov..) ... if (iobuf) iobuf_unref (iobuf) } rpcsvc_callback_submit (... iov...) { ... iobuf = iobuf_new iov1 = iobuf->ptr fill iobuf to contain xdrised rpc header - rpchdr msg.rpchdr = iov1 msg.proghdr = iov ... rpc_transport_submit_request (msg) ... if (iobuf) iobuf_unref (iobuf) } rpcsvc_callback_submit assumes that once rpc_transport_submit_request() returns the msg is written on to socket and thus the buffers(rpchdr, proghdr) can be freed, which is not the case. In especially high workload, rpc_transport_submit_request() may not be able to write to socket immediately and hence adds it to its own queue and returns as successful. Thus, we have use after free, for rpchdr and proghdr. Hence the clients gets garbage rpchdr and proghdr and thus fails to decode the rpc, resulting in disconnect. To prevent this, we need to add the rpchdr and proghdr to a iobref and send it in msg: iobref_add (iobref, iobufs) msg.iobref = iobref; The socket layer takes a ref on msg.iobref, if it cannot write to socket and is adding to the queue. Thus we do not have use after free. Thank You for discussing, debugging and fixing along: Prashanth Pai Raghavendra G Rajesh Joseph Kotresh HR Mohammed Rafi KC Soumya Koduri Change-Id: Ifa6bf6f4879141f42b46830a37c1574b21b37275 BUG: 1421937 Signed-off-by: Poornima G Reviewed-on: https://review.gluster.org/16613 Reviewed-by: Prashanth Pai Smoke: Gluster Build System Reviewed-by: soumya k NetBSD-regression: NetBSD Build System CentOS-regression: Gluster Build System Reviewed-by: Raghavendra G --- rpc/rpc-lib/src/rpcsvc.c | 33 +++++++++++++++++++++++++++++++-- rpc/rpc-lib/src/rpcsvc.h | 3 ++- 2 files changed, 33 insertions(+), 3 deletions(-) (limited to 'rpc') diff --git a/rpc/rpc-lib/src/rpcsvc.c b/rpc/rpc-lib/src/rpcsvc.c index 52b57205f6d..2be54a382f9 100644 --- a/rpc/rpc-lib/src/rpcsvc.c +++ b/rpc/rpc-lib/src/rpcsvc.c @@ -1014,6 +1014,7 @@ int rpcsvc_request_submit (rpcsvc_t *rpc, rpc_transport_t *trans, struct iovec iov = {0, }; struct iobuf *iobuf = NULL; ssize_t xdr_size = 0; + struct iobref *iobref = NULL; if (!req) goto out; @@ -1036,20 +1037,33 @@ int rpcsvc_request_submit (rpcsvc_t *rpc, rpc_transport_t *trans, iov.iov_len = ret; count = 1; + iobref = iobref_new (); + if (!iobref) { + ret = -1; + gf_log ("rpcsvc", GF_LOG_WARNING, "Failed to create iobref"); + goto out; + } + + iobref_add (iobref, iobuf); + ret = rpcsvc_callback_submit (rpc, trans, prog, procnum, - &iov, count); + &iov, count, iobref); out: if (iobuf) iobuf_unref (iobuf); + if (iobref) + iobref_unref (iobref); + return ret; } int rpcsvc_callback_submit (rpcsvc_t *rpc, rpc_transport_t *trans, rpcsvc_cbk_program_t *prog, int procnum, - struct iovec *proghdr, int proghdrcount) + struct iovec *proghdr, int proghdrcount, + struct iobref *iobref) { struct iobuf *request_iob = NULL; struct iovec rpchdr = {0,}; @@ -1057,6 +1071,7 @@ rpcsvc_callback_submit (rpcsvc_t *rpc, rpc_transport_t *trans, int ret = -1; int proglen = 0; uint32_t xid = 0; + gf_boolean_t new_iobref = _gf_false; if (!rpc) { goto out; @@ -1078,11 +1093,22 @@ rpcsvc_callback_submit (rpcsvc_t *rpc, rpc_transport_t *trans, "cannot build rpc-record"); goto out; } + if (!iobref) { + iobref = iobref_new (); + if (!iobref) { + gf_log ("rpcsvc", GF_LOG_WARNING, "Failed to create iobref"); + goto out; + } + new_iobref = 1; + } + + iobref_add (iobref, request_iob); req.msg.rpchdr = &rpchdr; req.msg.rpchdrcount = 1; req.msg.proghdr = proghdr; req.msg.proghdrcount = proghdrcount; + req.msg.iobref = iobref; ret = rpc_transport_submit_request (trans, &req); if (ret == -1) { @@ -1096,6 +1122,9 @@ rpcsvc_callback_submit (rpcsvc_t *rpc, rpc_transport_t *trans, out: iobuf_unref (request_iob); + if (new_iobref) + iobref_unref (iobref); + return ret; } diff --git a/rpc/rpc-lib/src/rpcsvc.h b/rpc/rpc-lib/src/rpcsvc.h index 63a6dad8c2f..cf3e5906de1 100644 --- a/rpc/rpc-lib/src/rpcsvc.h +++ b/rpc/rpc-lib/src/rpcsvc.h @@ -581,7 +581,8 @@ int rpcsvc_request_submit (rpcsvc_t *rpc, rpc_transport_t *trans, int rpcsvc_callback_submit (rpcsvc_t *rpc, rpc_transport_t *trans, rpcsvc_cbk_program_t *prog, int procnum, - struct iovec *proghdr, int proghdrcount); + struct iovec *proghdr, int proghdrcount, + struct iobref *iobref); rpcsvc_actor_t * rpcsvc_program_actor (rpcsvc_request_t *req); -- cgit