From 391e78cbaa727bdd274cf84d1d9683613c8cab6c Mon Sep 17 00:00:00 2001 From: Pranith Kumar K Date: Thu, 26 Nov 2015 09:58:39 +0530 Subject: features/bit-rot: Fix NULL dereference Backport of http://review.gluster.org/12754 Problem: By the time br_stub_worker is accessing this->private in it's thread, 'init' may not have set 'this->private = priv'. This leads to NULL dereference leading to brick crash. Fix: Set this->private before launching these threads. BUG: 1285758 Change-Id: I8a9234c4f96b0e5ea78f5b336369ec41f5a120ef Signed-off-by: Pranith Kumar K Reviewed-on: http://review.gluster.org/12764 Tested-by: NetBSD Build System Tested-by: Gluster Build System Reviewed-by: Venky Shankar --- xlators/features/bit-rot/src/stub/bit-rot-stub.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'xlators/features/bit-rot') diff --git a/xlators/features/bit-rot/src/stub/bit-rot-stub.c b/xlators/features/bit-rot/src/stub/bit-rot-stub.c index 12ea611aa11..39dddcd0ccc 100644 --- a/xlators/features/bit-rot/src/stub/bit-rot-stub.c +++ b/xlators/features/bit-rot/src/stub/bit-rot-stub.c @@ -159,7 +159,12 @@ init (xlator_t *this) pthread_cond_init (&priv->cond, NULL); INIT_LIST_HEAD (&priv->squeue); - ret = gf_thread_create (&priv->signth, NULL, br_stub_signth, priv); + /* Thread creations need 'this' to be passed so that THIS can be + * assigned inside the thread. So setting this->private here. + */ + this->private = priv; + + ret = gf_thread_create (&priv->signth, NULL, br_stub_signth, this); if (ret != 0) goto cleanup_lock; @@ -170,8 +175,6 @@ init (xlator_t *this) goto cleanup_lock; } - this->private = priv; - gf_msg_debug (this->name, 0, "bit-rot stub loaded"); return 0; @@ -183,6 +186,7 @@ init (xlator_t *this) mem_pool_destroy (priv->local_pool); free_priv: GF_FREE (priv); + this->private = NULL; error_return: return -1; } @@ -763,9 +767,11 @@ br_stub_perform_objsign (call_frame_t *frame, xlator_t *this, void * br_stub_signth (void *arg) { - br_stub_private_t *priv = arg; + xlator_t *this = arg; + br_stub_private_t *priv = this->private; struct br_stub_signentry *sigstub = NULL; + THIS = this; while (1) { pthread_mutex_lock (&priv->lock); { -- cgit