Bug 762778 (GLUSTER-1046)

Summary:	fd_t * being accessed after fd_unref()
Product:	[Community] GlusterFS	Reporter:	Krishna Srinivas <krishna>
Component:	nfs	Assignee:	Shehjar Tikoo <shehjart>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	mainline	CC:	gluster-bugs
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	nfs
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Krishna Srinivas 2010-07-04 00:30:49 UTC

nfs3svc_remove_cbk():
         if (openfd) {
                fd_unref (openfd);
                nfs3_fdcache_remove (nfs3, openfd);
         }

openfd is being accessed after unref() if it is the last unref then it might segfault

Comment 1 Shehjar Tikoo 2010-07-04 01:58:06 UTC

(In reply to comment #0)
> nfs3svc_remove_cbk():
>          if (openfd) {
>                 fd_unref (openfd);
>                 nfs3_fdcache_remove (nfs3, openfd);
>          }
> 
> openfd is being accessed after unref() if it is the last unref then it might
> segfault

This is not a bug. NFS has a fd cache which holds the last reference so it is ok for the fdcache code to access fd after it is unref'ed for a remove op.