Jim Chen has uploaded this change for review.
SAL: refcount shared callback state in nfs41_foreach_client_callback
nfs41_foreach_client_callback() passed the caller's heap-allocated
state pointer directly to every per-client async worker (client_cb) and
called gsh_free(cb_arg->state, MEM_COMP_STATE) inside each worker. With
N >= 2 NFSv4.1 clients, this triggered N-1 use-after-frees and
double-frees; with 0 NFSv4.1 clients (or when fridgethr_submit failed),
state was leaked.
Wrap state in a reference-counted struct client_callback_state so state
is freed exactly once after all queued per-client callbacks and the
table walk complete.
Change-Id: I5500d46a19fea3e2179ef747e4c8e19d6a7d8a66
Signed-off-by: Jim Chen <czcbangkai@google.com>
---
M src/SAL/nfs4_clientid.c
1 file changed, 28 insertions(+), 4 deletions(-)
git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/15/1256315/1
To view, visit change 1256315. To unsubscribe, or for help writing mail filters, visit settings.