Stefan Metzmacher ee02e40e86 ctdb-locking: Avoid memory corruption in ctdb_lock_context_destructor ... If the lock request is freed from within the callback, then setting lock_ctx->request to NULL in ctdb_lock_context_destructor will end up corrupting memory. In this case, lock_ctx->request could be reallocated and pointing to something else. This may cause unexpected abort trying to dereference a NULL pointer. So, set lock_ctx->request to NULL before processing callbacks. This avoids the following valgrind problem. ==3636== Invalid write of size 8 ==3636== at 0x151F3D: ctdb_lock_context_destructor (ctdb_lock.c:276) ==3636== by 0x58B3618: _talloc_free_internal (talloc.c:993) ==3636== by 0x58AD692: _talloc_free_children_internal (talloc.c:1472) ==3636== by 0x58AD692: _talloc_free_internal (talloc.c:1019) ==3636== by 0x58AD692: _talloc_free (talloc.c:1594) ==3636== by 0x15292E: ctdb_lock_handler (ctdb_lock.c:471) ==3636== by 0x56A535A: epoll_event_loop (tevent_epoll.c:728) ==3636== by 0x56A535A: epoll_event_loop_once (tevent_epoll.c:926) ==3636== by 0x56A3826: std_event_loop_once (tevent_standard.c:114) ==3636== by 0x569FFFC: _tevent_loop_once (tevent.c:533) ==3636== by 0x56A019A: tevent_common_loop_wait (tevent.c:637) ==3636== by 0x56A37C6: std_event_loop_wait (tevent_standard.c:140) ==3636== by 0x11E03A: ctdb_start_daemon (ctdb_daemon.c:1320) ==3636== by 0x118557: main (ctdbd.c:321) ==3636== Address 0x9c5b660 is 96 bytes inside a block of size 120 free'd ==3636== at 0x4C29D17: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==3636== by 0x58B32D3: _talloc_free_internal (talloc.c:1063) ==3636== by 0x58B3232: _talloc_free_children_internal (talloc.c:1472) ==3636== by 0x58B3232: _talloc_free_internal (talloc.c:1019) ==3636== by 0x58B3232: _talloc_free_children_internal (talloc.c:1472) ==3636== by 0x58B3232: _talloc_free_internal (talloc.c:1019) ==3636== by 0x58AD692: _talloc_free_children_internal (talloc.c:1472) ==3636== by 0x58AD692: _talloc_free_internal (talloc.c:1019) ==3636== by 0x58AD692: _talloc_free (talloc.c:1594) ==3636== by 0x11EC30: daemon_incoming_packet (ctdb_daemon.c:844) ==3636== by 0x136F4A: lock_fetch_callback (ctdb_ltdb_server.c:268) ==3636== by 0x152489: process_callbacks (ctdb_lock.c:353) ==3636== by 0x152489: ctdb_lock_handler (ctdb_lock.c:468) ==3636== by 0x56A535A: epoll_event_loop (tevent_epoll.c:728) ==3636== by 0x56A535A: epoll_event_loop_once (tevent_epoll.c:926) ==3636== by 0x56A3826: std_event_loop_once (tevent_standard.c:114) ==3636== by 0x569FFFC: _tevent_loop_once (tevent.c:533) ==3636== by 0x56A019A: tevent_common_loop_wait (tevent.c:637) ==3636== by 0x56A37C6: std_event_loop_wait (tevent_standard.c:140) ==3636== by 0x11E03A: ctdb_start_daemon (ctdb_daemon.c:1320) ==3636== by 0x118557: main (ctdbd.c:321) BUG: https://bugzilla.samba.org/show_bug.cgi?id=11293 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Amitay Isaacs <amitay@gmail.com>		2015-06-12 12:40:53 +02:00
..
ctdb_banning.c	ctdb-recoverd: Set recovery mode before freezing databases	2014-07-07 13:29:49 +02:00
ctdb_call.c	ctdb-call: Drop all deferred requests from older generation	2014-09-05 09:30:50 +02:00
ctdb_control.c	ctdb-daemon: Remove obsolete IPv4 only controls	2015-05-12 01:32:11 +02:00
ctdb_daemon.c	ctdb-daemon: Move release of all IPs to startup	2015-05-13 06:42:13 +02:00
ctdb_event_helper.c	ctdb-daemon: Improve error handling for running event scripts	2014-11-14 03:06:12 +01:00
ctdb_freeze.c	ctdb-util: Rename db_wrap to tdb_wrap and make it a build subsystem	2014-09-10 01:36:15 +02:00
ctdb_keepalive.c	Remove explicit include of lib/tevent/tevent.h.	2012-04-13 17:28:14 +10:00
ctdb_lock_helper.c	ctdb-daemon: Use correct tdb flags when enabling robust mutex support	2014-12-19 13:15:12 +01:00
ctdb_lock.c	ctdb-locking: Avoid memory corruption in ctdb_lock_context_destructor	2015-06-12 12:40:53 +02:00
ctdb_logging_file.c	ctdb-logging: New option CTDB_LOGGING, remove CTDB_LOGFILE, CTDB_SYSLOG	2014-10-28 05:42:04 +01:00
ctdb_logging_syslog.c	ctdb-logging: Add logging via UDP logging using RFC5424	2014-10-28 05:42:04 +01:00
ctdb_logging.c	ctdb/server: add format string checking to ctdb_tevent_logging()	2014-12-17 09:26:07 +01:00
ctdb_ltdb_server.c	ctdb-daemon: Fix typo in debug message	2015-05-10 06:10:21 +02:00
ctdb_monitor.c	ctdb-daemon: Move release of all IPs to startup	2015-05-13 06:42:13 +02:00
ctdb_persistent.c	ctdb-util: Rename db_wrap to tdb_wrap and make it a build subsystem	2014-09-10 01:36:15 +02:00
ctdb_recover.c	ctdb-daemon: Remove obsolete IPv4 only controls	2015-05-12 01:32:11 +02:00
ctdb_recoverd.c	ctdb-recovered: Drop unused variable	2015-06-05 11:28:23 +02:00
ctdb_server.c	ctdb-daemon: Move ctdb_read_nodes_file() to utilities	2015-03-23 12:23:12 +01:00
ctdb_serverids.c	RB_TREE: Add mechanism to abort a traverse	2011-11-08 13:40:28 +11:00
ctdb_statistics.c	Remove explicit include of lib/tevent/tevent.h.	2012-04-13 17:28:14 +10:00
ctdb_takeover.c	ctdb-daemon: Never release all IPs when DisableIPFailover is set	2015-05-13 06:42:13 +02:00
ctdb_traverse.c	ctdb-util: Rename db_wrap to tdb_wrap and make it a build subsystem	2014-09-10 01:36:15 +02:00
ctdb_tunables.c	ctdb-daemon: Drop tunable that is no longer in use	2015-03-27 06:40:08 +01:00
ctdb_update_record.c	ctdb-util: Rename db_wrap to tdb_wrap and make it a build subsystem	2014-09-10 01:36:15 +02:00
ctdb_uptime.c	Remove explicit include of lib/tevent/tevent.h.	2012-04-13 17:28:14 +10:00
ctdb_vacuum.c	ctdb-vacuum: Use non-blocking lock when traversing delete tree	2014-12-05 14:43:07 +01:00
ctdbd.c	ctdb-logging: New option CTDB_LOGGING, remove CTDB_LOGFILE, CTDB_SYSLOG	2014-10-28 05:42:04 +01:00
eventscript.c	ctdb-daemon: Initialise eventscript status earlier	2015-05-10 03:22:14 +02:00