Red Hat Bugzilla – Bug 764939
Null-pointer race in glusterfs_mgmt_init
Last modified: 2015-12-01 11:45:32 EST
I noticed during the development of the transport-multithreading patch (now part of the SSL-transport patch) that glusterfs_mgmt_init calls rpc_clnt_register_notify with mgmt_rpc_notify as an argument before it sets ctx->mgmt to a non-null value. That is incorrect, because mgmt_rpc_notify does try to dereference through that pointer. In my case it was being called immediately, and crashing on the null dereference. Moving the assignment in glusterfs_mgmt_init up a few lines seems correct, and resolved the issue.
CHANGE: http://review.gluster.com/77 (this is required because if 'CONNECT' event comes before the clnt_start()) merged in master by Anand Avati (email@example.com)
Fix committed to only master branch. For other branch, we can backport it if we see some issues.
/* This value should be set before doing the 'rpc_clnt_start()' as
the notify function uses this variable */
ctx->mgmt = rpc;
The above piece of code ensures that ctx->mgmt is being set to a non NULL value.