Bug 708335 - Fix coredump when rolling upgrade to Corosync 1.3
Summary: Fix coredump when rolling upgrade to Corosync 1.3
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: openais
Version: 5.6
Hardware: Unspecified
OS: Unspecified
low
medium
Target Milestone: rc
: ---
Assignee: Jan Friesse
QA Contact: Cluster QE
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-05-27 10:35 UTC by Jan Friesse
Modified: 2012-02-21 05:21 UTC (History)
4 users (show)

Fixed In Version: openais-0.80.6-32.el5
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-02-21 05:21:30 UTC
Target Upstream Version:


Attachments (Terms of Use)
Proposed patch (1.28 KB, patch)
2011-05-27 10:35 UTC, Jan Friesse
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2012:0180 0 normal SHIPPED_LIVE openais bug fix and enhancement update 2012-02-20 14:54:52 UTC

Description Jan Friesse 2011-05-27 10:35:59 UTC
Created attachment 501276 [details]
Proposed patch

Description of problem:

Patch fixes the rolling upgrade issue from openais whitetank to
corosync 1.3. The problem is the length of the array 
cpg_exec_service[]/cpg_exec_engine[] is different in the two version.

In openais whitetank:

static struct openais_exec_handler cpg_exec_service[] =
{
        { /* 0 */
                .exec_handler_fn        = message_handler_req_exec_cpg_procjoin,
                .exec_endian_convert_fn = exec_cpg_procjoin_endian_convert
        },
        { /* 1 */
                .exec_handler_fn        = message_handler_req_exec_cpg_procleave,
                .exec_endian_convert_fn = exec_cpg_procjoin_endian_convert
        },
        { /* 2 */
                .exec_handler_fn        = message_handler_req_exec_cpg_joinlist,
                .exec_endian_convert_fn = exec_cpg_joinlist_endian_convert
        },
        { /* 3 */
                .exec_handler_fn        = message_handler_req_exec_cpg_mcast,
                .exec_endian_convert_fn = exec_cpg_mcast_endian_convert
        },
        { /* 4 */
                .exec_handler_fn        = message_handler_req_exec_cpg_downlist,
                .exec_endian_convert_fn = exec_cpg_downlist_endian_convert
        },
};

In corosync:

static struct corosync_exec_handler cpg_exec_engine[] =
{
        { /* 0 */
                .exec_handler_fn        = message_handler_req_exec_cpg_procjoin,
                .exec_endian_convert_fn = exec_cpg_procjoin_endian_convert
        },
        { /* 1 */
                .exec_handler_fn        = message_handler_req_exec_cpg_procleave,
                .exec_endian_convert_fn = exec_cpg_procjoin_endian_convert
        },
        { /* 2 */
                .exec_handler_fn        = message_handler_req_exec_cpg_joinlist,
                .exec_endian_convert_fn = exec_cpg_joinlist_endian_convert
        },      
        { /* 3 */
                .exec_handler_fn        = message_handler_req_exec_cpg_mcast,
                .exec_endian_convert_fn = exec_cpg_mcast_endian_convert
        },
        { /* 4 */
                .exec_handler_fn        = message_handler_req_exec_cpg_downlist_old,
                .exec_endian_convert_fn = exec_cpg_downlist_endian_convert_old
        },
        { /* 5 */
                .exec_handler_fn        = message_handler_req_exec_cpg_downlist,
                .exec_endian_convert_fn = exec_cpg_downlist_endian_convert
        },
};


So the "old" node (with openais whitetank) will get a NULL pointer
when it recevies the message from the "new" node (with corosync 1.3)
and then coredump.


Expected results:
No crash

Comment 5 Jan Friesse 2011-11-16 12:36:11 UTC
node 1 running openais
node 2 running corosync

-> OpenAIS segfault

Comment 7 errata-xmlrpc 2012-02-21 05:21:30 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0180.html


Note You need to log in before you can comment on or make changes to this bug.