Bug 1502928 - Mishandling null check at send_brick_req of glusterfsd/src/gf_attach.c
Summary: Mishandling null check at send_brick_req of glusterfsd/src/gf_attach.c
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: GlusterFS
Classification: Community
Component: glusterd
Version: 3.10
Hardware: All
OS: All
unspecified
low
Target Milestone: ---
Assignee: bugs@gluster.org
QA Contact:
URL:
Whiteboard:
Depends On: 1503394 1505370
Blocks: 1504257
TreeView+ depends on / blocked
 
Reported: 2017-10-17 04:20 UTC by Alex CHEN
Modified: 2017-11-01 12:58 UTC (History)
3 users (show)

Fixed In Version: glusterfs-3.10.7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1503394 (view as bug list)
Environment:
Last Closed: 2017-11-01 12:58:54 UTC
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:


Attachments (Terms of Use)

Description Alex CHEN 2017-10-17 04:20:29 UTC
Description of problem:

There are three of `goto out` at `send_brick_req`

        iobuf = iobuf_get2 (rpc->ctx->iobuf_pool, req_size);
        if (!iobuf)
                goto out;

        iobref = iobref_new ();
        if (!iobref)
                goto out;

        frame = create_frame (this, this->ctx->pool);
        if (!frame)
                goto out;

that indicates the three of them (iobuf, iobref, frame) might be null and then jumps to label `out`.

but there might be null pointer dereference after label out:
out:
        iobref_unref (iobref);
        iobuf_unref (iobuf);
        STACK_DESTROY (frame->root);

the error handling code might not work as expected.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Worker Ant 2017-10-17 13:10:47 UTC
REVIEW: https://review.gluster.org/18538 (glusterd:Dereferencing the null pointer) posted (#1) for review on master by Sanju Rakonde (srakonde@redhat.com)

Comment 2 Worker Ant 2017-10-17 13:16:50 UTC
REVIEW: https://review.gluster.org/18538 (glusterd:Dereferencing the null pointer) posted (#2) for review on master by Sanju Rakonde (srakonde@redhat.com)

Comment 3 Worker Ant 2017-10-17 13:29:43 UTC
REVIEW: https://review.gluster.org/18539 (glusterd:Dereferencing the null pointer) posted (#1) for review on release-3.10 by Sanju Rakonde (srakonde@redhat.com)

Comment 4 Worker Ant 2017-10-23 12:23:15 UTC
REVIEW: https://review.gluster.org/18555 (glusterfsd: Dereferencing the null pointer) posted (#1) for review on release-3.10 by Sanju Rakonde (srakonde@redhat.com)

Comment 5 Worker Ant 2017-10-25 14:00:35 UTC
COMMIT: https://review.gluster.org/18555 committed in release-3.10 by Shyamsundar Ranganathan (srangana@redhat.com) 
------
commit e45b2a08222bd432e06c3b907bbeee4463e3d2a2
Author: Sanju Rakonde <srakonde@redhat.com>
Date:   Wed Oct 18 08:06:24 2017 +0530

    glusterfsd: Dereferencing the null pointer
    
    Problem: When control reaches to out, one of (iobref, iobuf, frame) can
    be null.for iobref, iobuf iobref_unref() and iobuf_unref() functions
    are called respectively, which are using GF_VALIDATE_OR_GOTO(), so
    there won't be null pointer dereference. But for frame without null
    checking STACK_DESTROY(frame->root) is called causing null pointer
    dereference.
    
    Fix: adding a line for null checking, the function
    STACK_DESTROY(frame->root) is called only when frame is not null.
    
    Change-Id: I3a6684c11fb7b694b81d6ad4fec3bced5562ad88
    BUG: 1502928
    Signed-off-by: Sanju Rakonde <srakonde@redhat.com>
    (cherry picked from commit 87bd25b64ae34cce95e87e724acfeab4c13d60a4)

Comment 6 Worker Ant 2017-11-01 04:58:23 UTC
REVIEW: https://review.gluster.org/18604 (glusterd : introduce timer in mgmt_v3_lock) posted (#1) for review on release-3.12 by Atin Mukherjee

Comment 7 Worker Ant 2017-11-01 05:00:54 UTC
REVISION POSTED: https://review.gluster.org/18604 (glusterd : introduce timer in mgmt_v3_lock) posted (#2) for review on release-3.12 by Atin Mukherjee

Comment 8 Shyamsundar 2017-11-01 12:58:54 UTC
This bug is getting closed because a release has been made available that should address the reported issue. In case the problem is still not fixed with glusterfs-3.10.7, please open a new bug report.

glusterfs-3.10.7 has been announced on the Gluster mailinglists [1], packages for several distributions should become available in the near future. Keep an eye on the Gluster Users mailinglist [2] and the update infrastructure for your distribution.

[1] http://lists.gluster.org/pipermail/announce/2017-November/000085.html
[2] https://www.gluster.org/pipermail/gluster-users/


Note You need to log in before you can comment on or make changes to this bug.