From: Serge Petrenko via Tarantool-patches <tarantool-patches@dev.tarantool.org> To: v.shpilevoy@tarantool.org, gorcunov@gmail.com Cc: tarantool-patches@dev.tarantool.org Subject: [Tarantool-patches] [PATCH] relay: fix use after free in subscribe_f Date: Wed, 12 May 2021 14:39:07 +0300 [thread overview] Message-ID: <20210512113907.12968-1-sergepetrenko@tarantool.org> (raw) relay_subscribe_f() remembered old recovery pointer, which might be replaced by relay_restart_recovery() if a raft message is delivered during cbus_process() loop in relay_send_is_raft_enabled(). Fix the issue by moving variable initialization below relay_send_is_raft_enabled() Closes #6031 --- https://github.com/tarantool/tarantool/issues/6031 https://github.com/tarantool/tarantool/tree/sp/gh-6031-use-after-free src/box/relay.cc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/box/relay.cc b/src/box/relay.cc index ff43c2fc7..32d3a58dd 100644 --- a/src/box/relay.cc +++ b/src/box/relay.cc @@ -741,7 +741,6 @@ static int relay_subscribe_f(va_list ap) { struct relay *relay = va_arg(ap, struct relay *); - struct recovery *r = relay->r; coio_enable(); relay_set_cord_name(relay->io.fd); @@ -756,6 +755,8 @@ relay_subscribe_f(va_list ap) if (!relay->replica->anon) relay_send_is_raft_enabled(relay, &raft_enabler, true); + struct recovery *r = relay->r; + /* * Setup garbage collection trigger. * Not needed for anonymous replicas, since they -- 2.30.1 (Apple Git-130)
next reply other threads:[~2021-05-12 11:39 UTC|newest] Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-05-12 11:39 Serge Petrenko via Tarantool-patches [this message] 2021-05-12 11:48 ` Cyrill Gorcunov via Tarantool-patches 2021-05-13 10:36 ` Serge Petrenko via Tarantool-patches 2021-05-12 20:25 ` Vladislav Shpilevoy via Tarantool-patches 2021-05-13 10:34 ` Serge Petrenko via Tarantool-patches 2021-05-13 11:23 ` Vladislav Shpilevoy via Tarantool-patches 2021-05-13 11:44 ` Cyrill Gorcunov via Tarantool-patches 2021-05-14 7:44 ` Kirill Yukhin via Tarantool-patches
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210512113907.12968-1-sergepetrenko@tarantool.org \ --to=tarantool-patches@dev.tarantool.org \ --cc=gorcunov@gmail.com \ --cc=sergepetrenko@tarantool.org \ --cc=v.shpilevoy@tarantool.org \ --subject='Re: [Tarantool-patches] [PATCH] relay: fix use after free in subscribe_f' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox