From: Nikita Pettik <korablev@tarantool.org> To: tarantool-patches@dev.tarantool.org Cc: v.shpilevoy@tarantool.org Subject: [Tarantool-patches] [PATCH v2 0/2] vinyl: fix uninitialized memory accesses Date: Wed, 15 Apr 2020 01:22:44 +0300 [thread overview] Message-ID: <cover.1586902245.git.korablev@tarantool.org> (raw) It is found that if vy_stmt_alloc() fails (due to OOM or most likely owing to exceeding max tuple size) during compaction process, it may result in instance crashes. This patch-set contains two fixes for problems connected with wrong handling of vy_stmt_alloc() failure. Branch: https://github.com/tarantool/tarantool/commits/np/gh-4864-access-to-uninit-mem Issue: https://github.com/tarantool/tarantool/issues/4864 Changes in v2: - replaced error injection ERRINJ_VY_MAX_TUPLE_SIZE with ERRINJ_VY_STMT_ALLOC (i.e. now vy_stmt_alloc() fails not due to exceed max size, but owing to allocation failure); - found another one use-after-free bug in case vy_read_view_merge() fails. Fix is merged into second patch; - added ERRINJ_VY_READ_VIEW_MERGE_FAIL to provide test case in case of vy_read_view_merge() failure; - fixed test covering second bug: error injection value accidentally was set to a wrong value (bad copy-paste). @ChangeLog: * Fixed crash during compaction due to tuples with size exceeding vinyl_max_tuple_size setting. Nikita Pettik (2): vinyl: init all vars before cleanup in vy_lsm_split_range() vinyl: clean-up unprocessed read views in *_build_read_views() src/box/vy_lsm.c | 4 +- src/box/vy_stmt.c | 10 + src/box/vy_write_iterator.c | 23 +- src/errinj.h | 2 + test/box/errinj.result | 2 + .../gh-4864-stmt-alloc-fail-compact.result | 237 ++++++++++++++++++ .../gh-4864-stmt-alloc-fail-compact.test.lua | 103 ++++++++ test/vinyl/suite.ini | 2 +- 8 files changed, 377 insertions(+), 6 deletions(-) create mode 100644 test/vinyl/gh-4864-stmt-alloc-fail-compact.result create mode 100644 test/vinyl/gh-4864-stmt-alloc-fail-compact.test.lua -- 2.17.1
next reply other threads:[~2020-04-14 22:22 UTC|newest] Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-04-14 22:22 Nikita Pettik [this message] 2020-04-14 22:22 ` [Tarantool-patches] [PATCH v2 1/2] vinyl: init all vars before cleanup in vy_lsm_split_range() Nikita Pettik 2020-04-14 22:22 ` [Tarantool-patches] [PATCH v2 2/2] vinyl: clean-up unprocessed read views in *_build_read_views() Nikita Pettik 2020-04-19 15:31 ` Vladislav Shpilevoy 2020-04-27 0:53 ` Nikita Pettik
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=cover.1586902245.git.korablev@tarantool.org \ --to=korablev@tarantool.org \ --cc=tarantool-patches@dev.tarantool.org \ --cc=v.shpilevoy@tarantool.org \ --subject='Re: [Tarantool-patches] [PATCH v2 0/2] vinyl: fix uninitialized memory accesses' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox