From: Serge Petrenko via Tarantool-patches <tarantool-patches@dev.tarantool.org>
To: Cyrill Gorcunov <gorcunov@gmail.com>
Cc: v.shpilevoy@tarantool.org, tarantool-patches@dev.tarantool.org
Subject: Re: [Tarantool-patches] [PATCH] relay: fix use after free in subscribe_f
Date: Thu, 13 May 2021 13:36:28 +0300 [thread overview]
Message-ID: <315ea728-412a-e4c9-a10a-662ca9058e15@tarantool.org> (raw)
In-Reply-To: <YJvAlgNUNrXpmese@grain>
12.05.2021 14:48, Cyrill Gorcunov пишет:
> On Wed, May 12, 2021 at 02:39:07PM +0300, Serge Petrenko wrote:
>> relay_subscribe_f() remembered old recovery pointer, which might be
>> replaced by relay_restart_recovery() if a raft message is delivered during
>> cbus_process() loop in relay_send_is_raft_enabled().
>>
>> Fix the issue by moving variable initialization below
>> relay_send_is_raft_enabled()
>>
>> Closes #6031
>> ---
>> https://github.com/tarantool/tarantool/issues/6031
>> https://github.com/tarantool/tarantool/tree/sp/gh-6031-use-after-free
>>
>> src/box/relay.cc | 3 ++-
>> 1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/src/box/relay.cc b/src/box/relay.cc
>> index ff43c2fc7..32d3a58dd 100644
>> --- a/src/box/relay.cc
>> +++ b/src/box/relay.cc
>> @@ -741,7 +741,6 @@ static int
>> relay_subscribe_f(va_list ap)
>> {
>> struct relay *relay = va_arg(ap, struct relay *);
>> - struct recovery *r = relay->r;
>>
>> coio_enable();
>> relay_set_cord_name(relay->io.fd);
>> @@ -756,6 +755,8 @@ relay_subscribe_f(va_list ap)
>> if (!relay->replica->anon)
>> relay_send_is_raft_enabled(relay, &raft_enabler, true);
>>
>> + struct recovery *r = relay->r;
> Could you please add a comment why it is important to fetch `relay->r`
> at exactly this stage. Something like
>
> /*
> * Fetching relay->r should be done after
> * cbus processing since the pointer may
> * be updated undeneath.
> */
> struct recovery *r = relay->r;
>
> Or something like this. Because commits messages are good but we
> read the code in first place and this very nontrivial moment.
Hi! Thanks for the review.
Vlad suggested to inline relay->r. It has only 2 usage places after all.
I agree this was nontrivial. It's better with the inline, I think.
--
Serge Petrenko
next prev parent reply other threads:[~2021-05-13 10:36 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-12 11:39 Serge Petrenko via Tarantool-patches
2021-05-12 11:48 ` Cyrill Gorcunov via Tarantool-patches
2021-05-13 10:36 ` Serge Petrenko via Tarantool-patches [this message]
2021-05-12 20:25 ` Vladislav Shpilevoy via Tarantool-patches
2021-05-13 10:34 ` Serge Petrenko via Tarantool-patches
2021-05-13 11:23 ` Vladislav Shpilevoy via Tarantool-patches
2021-05-13 11:44 ` Cyrill Gorcunov via Tarantool-patches
2021-05-14 7:44 ` Kirill Yukhin via Tarantool-patches
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=315ea728-412a-e4c9-a10a-662ca9058e15@tarantool.org \
--to=tarantool-patches@dev.tarantool.org \
--cc=gorcunov@gmail.com \
--cc=sergepetrenko@tarantool.org \
--cc=v.shpilevoy@tarantool.org \
--subject='Re: [Tarantool-patches] [PATCH] relay: fix use after free in subscribe_f' \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox