Attachment 18959 Details for Bug 16068 – Patch for v4-24-test, v4-23-test

[patch] Patch for v4-24-test, v4-23-test

BZ16068.patch (text/plain), 3.39 KB, created by Martin Schwenke on 2026-05-07 07:09:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Schwenke

Created: 2026-05-07 07:09:01 UTC

Size: 3.39 KB

patch

obsolete

>From 57e1654868da1ba3a2f045a0af7f55cdebac36d6 Mon Sep 17 00:00:00 2001
>From: Shachar Sharon <ssharon@redhat.com>
>Date: Tue, 5 May 2026 13:04:22 +0300
>Subject: [PATCH 1/2] ctdb-server: Fix use-after-free bug
>
>When 'rev_hdl->fde' is NULL due to failure in tevent_add_fd bail-out
>with free-and-error in order to avoid pointer dereferencing 'rev_hdl'
>after it is freed.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=16068
>
>Signed-off-by: Shachar Sharon <ssharon@redhat.com>
>Reviewed-by: Martin Schwenke <martin@meltin.net>
>Reviewed-by: Anoop C S <anoopcs@samba.org>
>Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
>Reviewed-by: Avan Thakkar <athakkar@redhat.com>
>(cherry picked from commit 88e09693a434d06ab57b14c1c1afe5996422ca0a)
>---
> ctdb/server/ctdb_call.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/ctdb/server/ctdb_call.c b/ctdb/server/ctdb_call.c
>index a51a92d3e45..ff13a59980b 100644
>--- a/ctdb/server/ctdb_call.c
>+++ b/ctdb/server/ctdb_call.c
>@@ -1958,7 +1958,7 @@ child_finished:
> 
> 	if (rev_hdl->fde == NULL) {
> 		D_ERR("Failed to set up fd event for revokechild process\n");
>-		talloc_free(rev_hdl);
>+		goto err_out;
> 	}
> 	tevent_fd_set_auto_close(rev_hdl->fde);
> 
>-- 
>2.47.3
>
>
>From 5a1f77493cab4198bb97a51bac896e6dc66c881a Mon Sep 17 00:00:00 2001
>From: Shachar Sharon <ssharon@redhat.com>
>Date: Tue, 5 May 2026 13:17:18 +0300
>Subject: [PATCH 2/2] ctdb-server: Cleanup child resources via local helper
>
>Define 'revokechild_finish' as resource cleanup helper. Call it either
>via destructor (normal case) or upon allocation failure.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=16068
>
>Signed-off-by: Shachar Sharon <ssharon@redhat.com>
>Reviewed-by: Martin Schwenke <martin@meltin.net>
>Reviewed-by: Anoop C S <anoopcs@samba.org>
>Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
>Reviewed-by: Avan Thakkar <athakkar@redhat.com>
>
>Autobuild-User(master): Martin Schwenke <martins@samba.org>
>Autobuild-Date(master): Wed May  6 05:28:48 UTC 2026 on atb-devel-224
>
>(cherry picked from commit 67f139ad28c6a771bac488b09d52dda81f3ffe81)
>---
> ctdb/server/ctdb_call.c | 20 +++++++++++++-------
> 1 file changed, 13 insertions(+), 7 deletions(-)
>
>diff --git a/ctdb/server/ctdb_call.c b/ctdb/server/ctdb_call.c
>index ff13a59980b..78ee39015e6 100644
>--- a/ctdb/server/ctdb_call.c
>+++ b/ctdb/server/ctdb_call.c
>@@ -1635,6 +1635,17 @@ static int deferred_call_destructor(struct revokechild_deferred_call *dcall)
> 	return 0;
> }
> 
>+static void revokechild_finish(struct revokechild_handle *rev_hdl)
>+{
>+	if (rev_hdl->fd[0] != -1) {
>+		close(rev_hdl->fd[0]);
>+	}
>+	if (rev_hdl->fd[1] != -1) {
>+		close(rev_hdl->fd[1]);
>+	}
>+	ctdb_kill(rev_hdl->ctdb, rev_hdl->child, SIGKILL);
>+}
>+
> static int revokechild_destructor(struct revokechild_handle *rev_hdl)
> {
> 	struct revokechild_deferred_call *now_list = NULL;
>@@ -1644,13 +1655,7 @@ static int revokechild_destructor(struct revokechild_handle *rev_hdl)
> 		talloc_free(rev_hdl->fde);
> 	}
> 
>-	if (rev_hdl->fd[0] != -1) {
>-		close(rev_hdl->fd[0]);
>-	}
>-	if (rev_hdl->fd[1] != -1) {
>-		close(rev_hdl->fd[1]);
>-	}
>-	ctdb_kill(rev_hdl->ctdb, rev_hdl->child, SIGKILL);
>+	revokechild_finish(rev_hdl);
> 
> 	DLIST_REMOVE(rev_hdl->ctdb_db->revokechild_active, rev_hdl);
> 
>@@ -1958,6 +1963,7 @@ child_finished:
> 
> 	if (rev_hdl->fde == NULL) {
> 		D_ERR("Failed to set up fd event for revokechild process\n");
>+		revokechild_finish(rev_hdl);
> 		goto err_out;
> 	}
> 	tevent_fd_set_auto_close(rev_hdl->fde);
>-- 
>2.47.3
>

Flags:

anoopcs: review+

Actions: View

Attachments on bug 16068: 18959