Bug 764939 (GLUSTER-3207) - Null-pointer race in glusterfs_mgmt_init
Summary: Null-pointer race in glusterfs_mgmt_init
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: GLUSTER-3207
Product: GlusterFS
Classification: Community
Component: glusterd
Version: mainline
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Amar Tumballi
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-07-20 19:14 UTC by Jeff Darcy
Modified: 2015-12-01 16:45 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions: master


Attachments (Terms of Use)

Description Jeff Darcy 2011-07-20 19:14:08 UTC
I noticed during the development of the transport-multithreading patch (now part of the SSL-transport patch) that glusterfs_mgmt_init calls rpc_clnt_register_notify with mgmt_rpc_notify as an argument before it sets ctx->mgmt to a non-null value.  That is incorrect, because mgmt_rpc_notify does try to dereference through that pointer.  In my case it was being called immediately, and crashing on the null dereference.  Moving the assignment in glusterfs_mgmt_init up a few lines seems correct, and resolved the issue.

Comment 1 Anand Avati 2011-07-28 08:16:16 UTC
CHANGE: http://review.gluster.com/77 (this is required because if 'CONNECT' event comes before the clnt_start()) merged in master by Anand Avati (avati)

Comment 2 Amar Tumballi 2011-07-28 08:49:21 UTC
Fix committed to only master branch. For other branch, we can backport it if we see some issues.

Comment 3 Raghavendra Bhat 2011-08-22 04:52:13 UTC
        /* This value should be set before doing the 'rpc_clnt_start()' as                                                                    
           the notify function uses this variable */
	ctx->mgmt = rpc;

The above piece of code ensures that ctx->mgmt is being set to a non NULL value.


Note You need to log in before you can comment on or make changes to this bug.