From a1919e91279a6c691fbd3dd6c0d97e74e78ccf22 Mon Sep 17 00:00:00 2001 From: Pranith Kumar K Date: Thu, 26 Nov 2015 09:58:39 +0530 Subject: features/bit-rot: Fix NULL dereference Problem: By the time br_stub_worker is accessing this->private in it's thread, 'init' may not have set 'this->private = priv'. This leads to NULL dereference leading to brick crash. Fix: Set this->private before launching these threads. Change-Id: Ic797eb195fdd0c70d19f28d0b97bc0181fd3dd2f BUG: 1285616 Signed-off-by: Pranith Kumar K Reviewed-on: http://review.gluster.org/12754 Tested-by: Gluster Build System Tested-by: NetBSD Build System Reviewed-by: Venky Shankar --- xlators/features/bit-rot/src/stub/bit-rot-stub.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'xlators/features/bit-rot') diff --git a/xlators/features/bit-rot/src/stub/bit-rot-stub.c b/xlators/features/bit-rot/src/stub/bit-rot-stub.c index 83a78604665..27a5ff7559a 100644 --- a/xlators/features/bit-rot/src/stub/bit-rot-stub.c +++ b/xlators/features/bit-rot/src/stub/bit-rot-stub.c @@ -154,7 +154,12 @@ init (xlator_t *this) pthread_cond_init (&priv->cond, NULL); INIT_LIST_HEAD (&priv->squeue); - ret = gf_thread_create (&priv->signth, NULL, br_stub_signth, priv); + /* Thread creations need 'this' to be passed so that THIS can be + * assigned inside the thread. So setting this->private here. + */ + this->private = priv; + + ret = gf_thread_create (&priv->signth, NULL, br_stub_signth, this); if (ret != 0) goto cleanup_lock; @@ -165,8 +170,6 @@ init (xlator_t *this) goto cleanup_lock; } - this->private = priv; - gf_msg_debug (this->name, 0, "bit-rot stub loaded"); return 0; @@ -178,6 +181,7 @@ init (xlator_t *this) mem_pool_destroy (priv->local_pool); free_priv: GF_FREE (priv); + this->private = NULL; error_return: return -1; } @@ -758,9 +762,11 @@ br_stub_perform_objsign (call_frame_t *frame, xlator_t *this, void * br_stub_signth (void *arg) { - br_stub_private_t *priv = arg; + xlator_t *this = arg; + br_stub_private_t *priv = this->private; struct br_stub_signentry *sigstub = NULL; + THIS = this; while (1) { pthread_mutex_lock (&priv->lock); { -- cgit