The Samba-Bugzilla – Attachment 16428 Details for
Bug 14625
smbd share mode double free crash
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
patch for 4.13
v4-13-memcache.patch (text/plain), 9.76 KB, created by
Andreas Schneider
on 2021-02-04 06:32:58 UTC
(
hide
)
Description:
patch for 4.13
Filename:
MIME Type:
Creator:
Andreas Schneider
Created:
2021-02-04 06:32:58 UTC
Size:
9.76 KB
patch
obsolete
>From 365714b8c19f13ca3df5d7adf71d40ac5980f2b3 Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Wed, 3 Feb 2021 10:30:08 +0100 >Subject: [PATCH 1/3] lib:util: Add basic memcache unit test > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14625 > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Ralph Boehme <slow@samba.org> >(cherry picked from commit bebbf621d6052f797c5cf19a2a9bbc13e699d3f0) >--- > lib/util/tests/test_memcache.c | 122 +++++++++++++++++++++++++++++++++ > lib/util/wscript_build | 8 ++- > selftest/tests.py | 2 + > 3 files changed, 131 insertions(+), 1 deletion(-) > create mode 100644 lib/util/tests/test_memcache.c > >diff --git a/lib/util/tests/test_memcache.c b/lib/util/tests/test_memcache.c >new file mode 100644 >index 00000000000..8ea5e5b042e >--- /dev/null >+++ b/lib/util/tests/test_memcache.c >@@ -0,0 +1,122 @@ >+/* >+ * Unix SMB/CIFS implementation. >+ * >+ * Copyright (C) 2021 Andreas Schneider <asn@samba.org> >+ * >+ * This program is free software; you can redistribute it and/or modify >+ * it under the terms of the GNU General Public License as published by >+ * the Free Software Foundation; either version 3 of the License, or >+ * (at your option) any later version. >+ * >+ * This program is distributed in the hope that it will be useful, >+ * but WITHOUT ANY WARRANTY; without even the implied warranty of >+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+ * GNU General Public License for more details. >+ * >+ * You should have received a copy of the GNU General Public License >+ * along with this program. If not, see <http://www.gnu.org/licenses/>. >+ */ >+ >+#include <stdarg.h> >+#include <stddef.h> >+#include <stdint.h> >+#include <setjmp.h> >+#include <cmocka.h> >+ >+#include "lib/replace/replace.h" >+#include "lib/util/talloc_stack.h" >+#include "lib/util/memcache.h" >+ >+static int setup_talloc_context(void **state) >+{ >+ TALLOC_CTX *frame = talloc_stackframe(); >+ >+ *state = frame; >+ return 0; >+} >+ >+static int teardown_talloc_context(void **state) >+{ >+ TALLOC_CTX *frame = *state; >+ TALLOC_FREE(frame); >+ return 0; >+} >+ >+static void torture_memcache_init(void **state) >+{ >+ TALLOC_CTX *mem_ctx = *state; >+ struct memcache *cache = NULL; >+ >+ cache = memcache_init(mem_ctx, 0); >+ assert_non_null(cache); >+ >+ TALLOC_FREE(cache); >+ >+ cache = memcache_init(mem_ctx, 10); >+ assert_non_null(cache); >+ >+ TALLOC_FREE(cache); >+} >+ >+static void torture_memcache_add_lookup_delete(void **state) >+{ >+ TALLOC_CTX *mem_ctx = *state; >+ struct memcache *cache = NULL; >+ DATA_BLOB key1, key2; >+ char *path1 = NULL, *path2 = NULL; >+ >+ cache = memcache_init(mem_ctx, 0); >+ assert_non_null(cache); >+ >+ key1 = data_blob_const("key1", 4); >+ path1 = talloc_strdup(mem_ctx, "/tmp/one"); >+ assert_non_null(path1); >+ >+ key2 = data_blob_const("key2", 4); >+ path2 = talloc_strdup(mem_ctx, "/tmp/two"); >+ assert_non_null(path1); >+ >+ memcache_add_talloc(cache, GETWD_CACHE, key1, &path1); >+ assert_null(path1); >+ >+ memcache_add_talloc(cache, GETWD_CACHE, key2, &path2); >+ assert_null(path2); >+ >+ path1 = memcache_lookup_talloc(cache, GETWD_CACHE, key1); >+ assert_non_null(path1); >+ assert_string_equal(path1, "/tmp/one"); >+ >+ path2 = memcache_lookup_talloc(cache, GETWD_CACHE, key2); >+ assert_non_null(path2); >+ assert_string_equal(path2, "/tmp/two"); >+ >+ memcache_delete(cache, GETWD_CACHE, key1); >+ path1 = memcache_lookup_talloc(cache, GETWD_CACHE, key1); >+ assert_null(path1); >+ >+ memcache_flush(cache, GETWD_CACHE); >+ path2 = memcache_lookup_talloc(cache, GETWD_CACHE, key2); >+ assert_null(path2); >+ >+ TALLOC_FREE(cache); >+} >+ >+int main(int argc, char *argv[]) >+{ >+ int rc; >+ const struct CMUnitTest tests[] = { >+ cmocka_unit_test(torture_memcache_init), >+ cmocka_unit_test(torture_memcache_add_lookup_delete), >+ }; >+ >+ if (argc == 2) { >+ cmocka_set_test_filter(argv[1]); >+ } >+ cmocka_set_message_output(CM_OUTPUT_SUBUNIT); >+ >+ rc = cmocka_run_group_tests(tests, >+ setup_talloc_context, >+ teardown_talloc_context); >+ >+ return rc; >+} >diff --git a/lib/util/wscript_build b/lib/util/wscript_build >index bf3e44bf1d2..5a8a04965ec 100644 >--- a/lib/util/wscript_build >+++ b/lib/util/wscript_build >@@ -310,4 +310,10 @@ else: > source='tests/test_util.c', > deps='cmocka replace talloc samba-util', > local_include=False, >- for_selftest=True); >+ for_selftest=True) >+ >+ bld.SAMBA_BINARY('test_memcache', >+ source='tests/test_memcache.c', >+ deps='cmocka replace talloc samba-util', >+ local_include=False, >+ for_selftest=True) >diff --git a/selftest/tests.py b/selftest/tests.py >index 6918e1306c3..2b65943b2ed 100644 >--- a/selftest/tests.py >+++ b/selftest/tests.py >@@ -398,6 +398,8 @@ plantestsuite("samba.unittests.util_paths", "none", > [os.path.join(bindir(), "default/lib/util/test_util_paths")]) > plantestsuite("samba.unittests.util", "none", > [os.path.join(bindir(), "default/lib/util/test_util")]) >+plantestsuite("samba.unittests.memcache", "none", >+ [os.path.join(bindir(), "default/lib/util/test_memcache")]) > plantestsuite("samba.unittests.ntlm_check", "none", > [os.path.join(bindir(), "default/libcli/auth/test_ntlm_check")]) > plantestsuite("samba.unittests.gnutls", "none", >-- >2.30.0 > > >From 5a5450eb6b85b11e24eec241ee6d8f386a001cbc Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Wed, 3 Feb 2021 10:37:12 +0100 >Subject: [PATCH 2/3] lib:util: Add cache oversize test for memcache > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14625 > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Ralph Boehme <slow@samba.org> >(cherry picked from commit 00543ab3b29e3fbfe8314e51919629803e14ede6) >--- > lib/util/tests/test_memcache.c | 39 ++++++++++++++++++++++++++++++++++ > selftest/knownfail.d/memcache | 1 + > 2 files changed, 40 insertions(+) > create mode 100644 selftest/knownfail.d/memcache > >diff --git a/lib/util/tests/test_memcache.c b/lib/util/tests/test_memcache.c >index 8ea5e5b042e..8a3997817c1 100644 >--- a/lib/util/tests/test_memcache.c >+++ b/lib/util/tests/test_memcache.c >@@ -98,6 +98,44 @@ static void torture_memcache_add_lookup_delete(void **state) > path2 = memcache_lookup_talloc(cache, GETWD_CACHE, key2); > assert_null(path2); > >+ TALLOC_FREE(path1); >+ TALLOC_FREE(path2); >+ TALLOC_FREE(cache); >+} >+ >+static void torture_memcache_add_oversize(void **state) >+{ >+ TALLOC_CTX *mem_ctx = *state; >+ struct memcache *cache = NULL; >+ DATA_BLOB key1, key2; >+ char *path1 = NULL, *path2 = NULL; >+ >+ cache = memcache_init(mem_ctx, 10); >+ assert_non_null(cache); >+ >+ key1 = data_blob_const("key1", 4); >+ path1 = talloc_strdup(mem_ctx, "/tmp/one"); >+ assert_non_null(path1); >+ >+ key2 = data_blob_const("key2", 4); >+ path2 = talloc_strdup(mem_ctx, "/tmp/two"); >+ assert_non_null(path1); >+ >+ memcache_add_talloc(cache, GETWD_CACHE, key1, &path1); >+ assert_null(path1); >+ >+ memcache_add_talloc(cache, GETWD_CACHE, key2, &path2); >+ assert_null(path2); >+ >+ path1 = memcache_lookup_talloc(cache, GETWD_CACHE, key1); >+ assert_null(path1); >+ >+ path2 = memcache_lookup_talloc(cache, GETWD_CACHE, key2); >+ assert_non_null(path2); >+ assert_string_equal(path2, "/tmp/two"); >+ >+ TALLOC_FREE(path1); >+ TALLOC_FREE(path2); > TALLOC_FREE(cache); > } > >@@ -107,6 +145,7 @@ int main(int argc, char *argv[]) > const struct CMUnitTest tests[] = { > cmocka_unit_test(torture_memcache_init), > cmocka_unit_test(torture_memcache_add_lookup_delete), >+ cmocka_unit_test(torture_memcache_add_oversize), > }; > > if (argc == 2) { >diff --git a/selftest/knownfail.d/memcache b/selftest/knownfail.d/memcache >new file mode 100644 >index 00000000000..0a74ace3003 >--- /dev/null >+++ b/selftest/knownfail.d/memcache >@@ -0,0 +1 @@ >+^samba.unittests.memcache.torture_memcache_add_oversize >-- >2.30.0 > > >From c17423e04cb6be3e01e8642e1a761a1e1e3d8d2f Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Tue, 2 Feb 2021 18:10:38 +0100 >Subject: [PATCH 3/3] lib:util: Avoid free'ing our own pointer > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14625 > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Ralph Boehme <slow@samba.org> >(cherry picked from commit 0bdbe50fac680be3fe21043246b8c75005611351) >--- > lib/util/memcache.c | 19 +++++++++++++++---- > selftest/knownfail.d/memcache | 1 - > 2 files changed, 15 insertions(+), 5 deletions(-) > delete mode 100644 selftest/knownfail.d/memcache > >diff --git a/lib/util/memcache.c b/lib/util/memcache.c >index 1e616bd0e9a..7b0b27eaddb 100644 >--- a/lib/util/memcache.c >+++ b/lib/util/memcache.c >@@ -223,14 +223,25 @@ static void memcache_delete_element(struct memcache *cache, > TALLOC_FREE(e); > } > >-static void memcache_trim(struct memcache *cache) >+static void memcache_trim(struct memcache *cache, struct memcache_element *e) > { >+ struct memcache_element *tail = NULL; >+ > if (cache->max_size == 0) { > return; > } > >- while ((cache->size > cache->max_size) && DLIST_TAIL(cache->mru)) { >- memcache_delete_element(cache, DLIST_TAIL(cache->mru)); >+ for (tail = DLIST_TAIL(cache->mru); >+ (cache->size > cache->max_size) && (tail != NULL); >+ tail = DLIST_TAIL(cache->mru)) >+ { >+ if (tail == e) { >+ tail = DLIST_PREV(tail); >+ if (tail == NULL) { >+ break; >+ } >+ } >+ memcache_delete_element(cache, tail); > } > } > >@@ -351,7 +362,7 @@ void memcache_add(struct memcache *cache, enum memcache_number n, > memcpy(&mtv, cache_value.data, sizeof(mtv)); > cache->size += mtv.len; > } >- memcache_trim(cache); >+ memcache_trim(cache, e); > } > > void memcache_add_talloc(struct memcache *cache, enum memcache_number n, >diff --git a/selftest/knownfail.d/memcache b/selftest/knownfail.d/memcache >deleted file mode 100644 >index 0a74ace3003..00000000000 >--- a/selftest/knownfail.d/memcache >+++ /dev/null >@@ -1 +0,0 @@ >-^samba.unittests.memcache.torture_memcache_add_oversize >-- >2.30.0 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Flags:
slow
:
review+
Actions:
View
Attachments on
bug 14625
:
16418
|
16421
|
16427
| 16428 |
16429