Bug 1502928
| Summary: | Mishandling null check at send_brick_req of glusterfsd/src/gf_attach.c | |||
|---|---|---|---|---|
| Product: | [Community] GlusterFS | Reporter: | Alex CHEN <alexc> | |
| Component: | glusterd | Assignee: | bugs <bugs> | |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | ||
| Severity: | low | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 3.10 | CC: | amukherj, bugs, srakonde | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | All | |||
| Whiteboard: | ||||
| Fixed In Version: | glusterfs-3.10.7 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1503394 (view as bug list) | Environment: | ||
| Last Closed: | 2017-11-01 12:58:54 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 1503394, 1505370 | |||
| Bug Blocks: | 1504257 | |||
REVIEW: https://review.gluster.org/18538 (glusterd:Dereferencing the null pointer) posted (#1) for review on master by Sanju Rakonde (srakonde) REVIEW: https://review.gluster.org/18538 (glusterd:Dereferencing the null pointer) posted (#2) for review on master by Sanju Rakonde (srakonde) REVIEW: https://review.gluster.org/18539 (glusterd:Dereferencing the null pointer) posted (#1) for review on release-3.10 by Sanju Rakonde (srakonde) REVIEW: https://review.gluster.org/18555 (glusterfsd: Dereferencing the null pointer) posted (#1) for review on release-3.10 by Sanju Rakonde (srakonde) COMMIT: https://review.gluster.org/18555 committed in release-3.10 by Shyamsundar Ranganathan (srangana) ------ commit e45b2a08222bd432e06c3b907bbeee4463e3d2a2 Author: Sanju Rakonde <srakonde> Date: Wed Oct 18 08:06:24 2017 +0530 glusterfsd: Dereferencing the null pointer Problem: When control reaches to out, one of (iobref, iobuf, frame) can be null.for iobref, iobuf iobref_unref() and iobuf_unref() functions are called respectively, which are using GF_VALIDATE_OR_GOTO(), so there won't be null pointer dereference. But for frame without null checking STACK_DESTROY(frame->root) is called causing null pointer dereference. Fix: adding a line for null checking, the function STACK_DESTROY(frame->root) is called only when frame is not null. Change-Id: I3a6684c11fb7b694b81d6ad4fec3bced5562ad88 BUG: 1502928 Signed-off-by: Sanju Rakonde <srakonde> (cherry picked from commit 87bd25b64ae34cce95e87e724acfeab4c13d60a4) REVIEW: https://review.gluster.org/18604 (glusterd : introduce timer in mgmt_v3_lock) posted (#1) for review on release-3.12 by Atin Mukherjee REVISION POSTED: https://review.gluster.org/18604 (glusterd : introduce timer in mgmt_v3_lock) posted (#2) for review on release-3.12 by Atin Mukherjee This bug is getting closed because a release has been made available that should address the reported issue. In case the problem is still not fixed with glusterfs-3.10.7, please open a new bug report. glusterfs-3.10.7 has been announced on the Gluster mailinglists [1], packages for several distributions should become available in the near future. Keep an eye on the Gluster Users mailinglist [2] and the update infrastructure for your distribution. [1] http://lists.gluster.org/pipermail/announce/2017-November/000085.html [2] https://www.gluster.org/pipermail/gluster-users/ |
Description of problem: There are three of `goto out` at `send_brick_req` iobuf = iobuf_get2 (rpc->ctx->iobuf_pool, req_size); if (!iobuf) goto out; iobref = iobref_new (); if (!iobref) goto out; frame = create_frame (this, this->ctx->pool); if (!frame) goto out; that indicates the three of them (iobuf, iobref, frame) might be null and then jumps to label `out`. but there might be null pointer dereference after label out: out: iobref_unref (iobref); iobuf_unref (iobuf); STACK_DESTROY (frame->root); the error handling code might not work as expected. Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info: