File: 09-fix-stack-overflow-in-inode-destroy.diff

package info (click to toggle)
glusterfs 11.1-6
  • links: PTS
  • area: main
  • in suites: forky, sid, trixie
  • size: 45,156 kB
  • sloc: ansic: 467,237; sh: 51,851; python: 12,989; makefile: 1,962; yacc: 487; lisp: 124; lex: 61; xml: 14
file content (45 lines) | stat: -rw-r--r-- 1,597 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
Description: Fix stack overflow in __inode_destroy
 A recursive call to inode_unref was introduced when support for inode-level
 namespaces was added. This results in a stack overflow under certain
 conditions leading to brick SEGFAULTs. This patch removes the recurisve call
 to inode_unref. This was fixed upstream but is yet to be included in a
 release.
 .
 glusterfs (11.1-4ubuntu1) noble; urgency=medium
 .
   * Fix stack overflow in __inode_destroy (LP: #2064843)
Origin: upstream, https://github.com/gluster/glusterfs/commit/da2391dacd3483555e91a33ecdf89948be62b691
Bug: https://github.com/gluster/glusterfs/issues/4295
Bug-Ubuntu: https://launchpad.net/bugs/2064843
Author: Mohit Agrawal <moagrawa@redhat.com>
Reviewed-By: Xavi Hernandez <xhernandez@gmail.com>
Reviewed-By: Amar Tumballi <amar@dhiway.com>
Reviewed-By: Bryce Harrington <bryce.harrington@canonical.com>
Last-Update: 2024-05-08

---

--- glusterfs-11.1.orig/libglusterfs/src/inode.c
+++ glusterfs-11.1/libglusterfs/src/inode.c
@@ -351,9 +351,19 @@ __inode_ctx_free(inode_t *inode)
 static void
 __inode_destroy(inode_t *inode)
 {
-    inode_unref(inode->ns_inode);
-    __inode_ctx_free(inode);
+    inode_table_t *table = NULL;
+    inode_t *ns_inode = inode->ns_inode;
+
+    if (ns_inode) {
+        table = ns_inode->table;
+        pthread_mutex_lock(&table->lock);
+        {
+            __inode_unref(ns_inode, false);
+        }
+        pthread_mutex_unlock(&table->lock);
+    }
 
+    __inode_ctx_free(inode);
     LOCK_DESTROY(&inode->lock);
     //  memset (inode, 0xb, sizeof (*inode));
     GF_FREE(inode);