shaba/lvm2
1
0
Fork 0
mirror of git://sourceware.org/git/lvm2.git synced 2025-03-10 16:58:47 +03:00
Code Releases Activity

report: fix invalid memory read when reporting cache LV policy name

Browse Source 
Fix regression caused by commit c2d4330f27277717bc3b684b702189079b257b77
which removed the dm_pool_strdup for the cache policy name in
_cache_policy_disp report function.

This regression was hit with buffered reporting only (which is
used by default). The reason is that for buffered reporting, we're
iterating over LVs in VG (process_each_lv) while gathering
all the information that is needed for the report. In this case,
the LV's cache policy name has not been duped, but only the pointer
to the original VG buffer was stored. When the LV iteration finished,
the VG buffer was freed and any report to output called later
(dm_report_output call) accessed already freed VG data.

This didn't appear if unbuffered reporting was used (--unbuffered)
because in this case, the data were reported to output as
soon as they were processed, hence it was reported to output
before the VG data was freed.
This commit is contained in:
Peter Rajnoha 2016-01-11 12:51:08 +01:00
parent 0dac4f09b4
commit a83d611a86
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
WHATS_NEW
View File

@ -1,5 +1,6 @@
Version 2.02.140 - Version 2.02.140 -
=================================== ===================================
Fix invalid memory read when reporting cache LV policy_name (2.02.126).
Version 2.02.139 - 8th January 2016 Version 2.02.139 - 8th January 2016
=================================== ===================================

8
lib/report/report.c
View File

@ -1417,6 +1417,7 @@ static int _cache_policy_disp(struct dm_report *rh, struct dm_pool *mem,
const void *data, void *private) const void *data, void *private)
{ {
const struct lv_segment *seg = (const struct lv_segment *) data; const struct lv_segment *seg = (const struct lv_segment *) data;
const char *cache_policy_name;
if (seg_is_cache(seg)) if (seg_is_cache(seg))
seg = first_seg(seg->pool_lv); seg = first_seg(seg->pool_lv);
@ -1429,7 +1430,12 @@ static int _cache_policy_disp(struct dm_report *rh, struct dm_pool *mem,
return 0; return 0;
} }
return _field_set_value(field, seg->policy_name, NULL); if (!(cache_policy_name = dm_pool_strdup(mem, seg->policy_name))) {
log_error("dm_pool_strdup failed");
return 0;
}
return _field_set_value(field, cache_policy_name, NULL);
} }
static int _modules_disp(struct dm_report *rh, struct dm_pool *mem, static int _modules_disp(struct dm_report *rh, struct dm_pool *mem,