graph/shd: Use top down approach while cleaning xlator

We were cleaning xlator from botton to top, which might
lead to problems when upper xlators trying to access
the xlator object loaded below.

One such scenario is when fd_unref happens as part of the
fini call which might lead to calling the releasedir to
lower xlator. This will lead to invalid mem access

Change-Id: I8a6cb619256fab0b0c01a2d564fc88287c4415a0
Updates: bz#1716695
Signed-off-by: Mohammed Rafi KC <rkavunga@redhat.com>

10 files changed, 21 insertions, 2 deletions

diff --git a/libglusterfs/src/graph.c b/libglusterfs/src/graph.c
index aea74a5eda..0b99e61819 100644
--- a/libglusterfs/src/graph.c
+++ b/libglusterfs/src/graph.c
@@ -1200,6 +1200,14 @@ glusterfs_graph_fini(glusterfs_graph_t *graph)
         if (trav->init_succeeded) {
             trav->cleanup_starting = 1;
             trav->fini(trav);
+            if (trav->local_pool) {
+                mem_pool_destroy(trav->local_pool);
+                trav->local_pool = NULL;
+            }
+            if (trav->itable) {
+                inode_table_destroy(trav->itable);
+                trav->itable = NULL;
+            }
             trav->init_succeeded = 0;
         }
         trav = trav->next;
@@ -1401,7 +1409,7 @@ glusterfs_graph_cleanup(void *arg)
 
     pthread_mutex_lock(&ctx->cleanup_lock);
     {
-        glusterfs_graph_deactivate(graph);
+        glusterfs_graph_fini(graph);
         glusterfs_graph_destroy(graph);
     }
     pthread_mutex_unlock(&ctx->cleanup_lock);
diff --git a/xlators/features/bit-rot/src/stub/bit-rot-stub.c b/xlators/features/bit-rot/src/stub/bit-rot-stub.c
index e6d64de99a..de2184d619 100644
--- a/xlators/features/bit-rot/src/stub/bit-rot-stub.c
+++ b/xlators/features/bit-rot/src/stub/bit-rot-stub.c
@@ -196,6 +196,7 @@ cleanup_lock:
     pthread_mutex_destroy(&priv->lock);
 free_mempool:
     mem_pool_destroy(priv->local_pool);
+    priv->local_pool = NULL;
 free_priv:
     GF_FREE(priv);
     this->private = NULL;
diff --git a/xlators/features/changelog/src/changelog.c b/xlators/features/changelog/src/changelog.c
index d9025f344c..2862d1e2c3 100644
--- a/xlators/features/changelog/src/changelog.c
+++ b/xlators/features/changelog/src/changelog.c
@@ -2790,6 +2790,7 @@ cleanup_options:
     changelog_freeup_options(this, priv);
 cleanup_mempool:
     mem_pool_destroy(this->local_pool);
+    this->local_pool = NULL;
 cleanup_priv:
     GF_FREE(priv);
 error_return:
diff --git a/xlators/features/cloudsync/src/cloudsync.c b/xlators/features/cloudsync/src/cloudsync.c
index 26e512c3af..0ad987ecf5 100644
--- a/xlators/features/cloudsync/src/cloudsync.c
+++ b/xlators/features/cloudsync/src/cloudsync.c
@@ -200,8 +200,10 @@ cs_init(xlator_t *this)
 
 out:
     if (ret == -1) {
-        if (this->local_pool)
+        if (this->local_pool) {
             mem_pool_destroy(this->local_pool);
+            this->local_pool = NULL;
+        }
 
         cs_cleanup_private(priv);
 
diff --git a/xlators/features/index/src/index.c b/xlators/features/index/src/index.c
index 2f2a6d04fb..4ece7ff6fc 100644
--- a/xlators/features/index/src/index.c
+++ b/xlators/features/index/src/index.c
@@ -2478,6 +2478,7 @@ out:
             GF_FREE(priv);
         this->private = NULL;
         mem_pool_destroy(this->local_pool);
+        this->local_pool = NULL;
     }
 
     if (attr_inited)
diff --git a/xlators/features/quiesce/src/quiesce.c b/xlators/features/quiesce/src/quiesce.c
index 218db9c921..4b709f12fe 100644
--- a/xlators/features/quiesce/src/quiesce.c
+++ b/xlators/features/quiesce/src/quiesce.c
@@ -2527,6 +2527,7 @@ fini(xlator_t *this)
     this->private = NULL;
 
     mem_pool_destroy(priv->local_pool);
+    priv->local_pool = NULL;
     LOCK_DESTROY(&priv->lock);
     GF_FREE(priv);
 out:
diff --git a/xlators/features/read-only/src/worm.c b/xlators/features/read-only/src/worm.c
index f59663802e..48d62e0ed8 100644
--- a/xlators/features/read-only/src/worm.c
+++ b/xlators/features/read-only/src/worm.c
@@ -576,6 +576,7 @@ fini(xlator_t *this)
     mem_put(priv);
     this->private = NULL;
     mem_pool_destroy(this->local_pool);
+    this->local_pool = NULL;
 out:
     return;
 }
diff --git a/xlators/features/sdfs/src/sdfs.c b/xlators/features/sdfs/src/sdfs.c
index 3460b47582..aaf13f0852 100644
--- a/xlators/features/sdfs/src/sdfs.c
+++ b/xlators/features/sdfs/src/sdfs.c
@@ -1436,6 +1436,7 @@ void
 fini(xlator_t *this)
 {
     mem_pool_destroy(this->local_pool);
+    this->local_pool = NULL;
     return;
 }
 
diff --git a/xlators/features/selinux/src/selinux.c b/xlators/features/selinux/src/selinux.c
index e8e16cde8c..9b1b4b55e1 100644
--- a/xlators/features/selinux/src/selinux.c
+++ b/xlators/features/selinux/src/selinux.c
@@ -252,6 +252,7 @@ out:
     if (ret) {
         GF_FREE(priv);
         mem_pool_destroy(this->local_pool);
+        this->local_pool = NULL;
     }
     return ret;
 }
@@ -280,6 +281,7 @@ fini(xlator_t *this)
     GF_FREE(priv);
 
     mem_pool_destroy(this->local_pool);
+    this->local_pool = NULL;
 
     return;
 }
diff --git a/xlators/features/trash/src/trash.c b/xlators/features/trash/src/trash.c
index f96ed73c10..f44b11c687 100644
--- a/xlators/features/trash/src/trash.c
+++ b/xlators/features/trash/src/trash.c
@@ -2523,6 +2523,7 @@ out:
             GF_FREE(priv);
         }
         mem_pool_destroy(this->local_pool);
+        this->local_pool = NULL;
     }
     return ret;
 }