From 7fbb6b8f15ee34d4432b647c40fe66346ff0295d Mon Sep 17 00:00:00 2001
From: robertc <>
Date: Sun, 31 Aug 2003 18:44:30 +0000
Subject: [PATCH] Summary: Fix race in UFS code. Keywords:

UFS had a race leading to a refcount triggered free within a method.
---
 src/StoreIOState.cc        |  4 +++-
 src/fs/ufs/store_io_ufs.cc | 11 +++++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/StoreIOState.cc b/src/StoreIOState.cc
index c6eb20834b..a2bfb963d5 100644
--- a/src/StoreIOState.cc
+++ b/src/StoreIOState.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: StoreIOState.cc,v 1.3 2003/02/21 22:50:06 robertc Exp $
+ * $Id: StoreIOState.cc,v 1.4 2003/08/31 12:44:30 robertc Exp $
  *
  * DEBUG: section ??    Swap Dir base object
  * AUTHOR: Robert Collins
@@ -59,6 +59,8 @@ storeIOState::offset() const
 
 storeIOState::~storeIOState()
 {
+    debugs(20,3, "StoreIOState::~StoreIOState: " << this);
+
     if (read.callback_data)
         cbdataReferenceDone(read.callback_data);
 
diff --git a/src/fs/ufs/store_io_ufs.cc b/src/fs/ufs/store_io_ufs.cc
index b7bd27016e..ec4311e4a4 100644
--- a/src/fs/ufs/store_io_ufs.cc
+++ b/src/fs/ufs/store_io_ufs.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: store_io_ufs.cc,v 1.22 2003/08/04 22:14:53 robertc Exp $
+ * $Id: store_io_ufs.cc,v 1.23 2003/08/31 12:44:31 robertc Exp $
  *
  * DEBUG: section 79    Storage Manager UFS Interface
  * AUTHOR: Duane Wessels
@@ -471,9 +471,6 @@ void
 UFSStoreState::doCallback(int errflag)
 {
     debug(79, 3) ("storeUfsIOCallback: errflag=%d\n", errflag);
-    /* We are finished with the file as this is on close or error only.*/
-    theFile = NULL;
-
     STIOCB *theCallback = callback;
     callback = NULL;
 
@@ -481,6 +478,12 @@ UFSStoreState::doCallback(int errflag)
 
     if (cbdataReferenceValidDone(callback_data, &cbdata) && theCallback)
         theCallback(cbdata, errflag, this);
+
+    /* We are finished with the file as this is on close or error only.*/
+    /* This must be the last line, as theFile may be the only object holding
+     * us in memory 
+     */
+    theFile = NULL;
 }
 
 /* ============= THE REAL UFS CODE ================ */
-- 
2.47.2