Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

DAOS-16466 misc: Backport fixes (#15045) #15139

Merged
merged 5 commits into from
Sep 20, 2024
Merged

DAOS-16466 misc: Backport fixes (#15045) #15139

merged 5 commits into from
Sep 20, 2024

Conversation

liw
Copy link
Contributor

@liw liw commented Sep 17, 2024 •
edited
Loading

Backport the following fixes, mostly related to memory access, from master:

  1. DAOS-16466 object: Fix obj_ec_singv_split overflow #15045
  2. DAOS-16251 dtx: Fix dtx_req_send user-after-free #15035
  3. DAOS-16251 mgmt: Fix use-after-free in pool_list #15014
  4. DAOS-16251 tests: Fix various buffer overflows #15003
  5. DAOS-16251 engine: Misc fixes and cleanups #14983

Before requesting gatekeeper:

  • Two review approvals and any prior change requests have been resolved.
  • Testing is complete and all tests passed or there is a reason documented in the PR why it should be force landed and forced-landing tag is set.
  • Features: (or Test-tag*) commit pragma was used or there is a reason documented that there are no appropriate tags for this PR.
  • Commit messages follows the guidelines outlined here.
  • Any tests skipped by the ticket being addressed have been run and passed in the PR.

Gatekeeper:

  • You are the appropriate gatekeeper to be landing the patch.
  • The PR has 2 reviews by people familiar with the code, including appropriate owners.
  • Githooks were used. If not, request that user install them and check copyright dates.
  • Checkpatch issues are resolved. Pay particular attention to ones that will show up on future PRs.
  • All builds have passed. Check non-required builds for any new compiler warnings.
  • Sufficient testing is done. Check feature pragmas and test tags and that tests skipped for the ticket are run and now pass with the changes.
  • If applicable, the PR has addressed any potential version compatibility issues.
  • Check the target branch. If it is master branch, should the PR go to a feature branch? If it is a release branch, does it have merge approval in the JIRA ticket.
  • Extra checks if forced landing is requested
    • Review comments are sufficiently resolved, particularly by prior reviewers that requested changes.
    • No new NLT or valgrind warnings. Check the classic view.
    • Quick-build or Quick-functional is not used.
  • Fix the commit message upon landing. Check the standard here. Edit it to create a single commit. If necessary, ask submitter for a new summary.

@liw
DAOS-16251 object: Fix obj_ec_singv_split overflow (#15045)
a4367a3 
It has been seen that obj_ec_singv_split may read beyond the end of
sgl->sg_iovs[0].iov_buf:

    iod_size=8569
    c_bytes=4288
    id_shard=0
    tgt_off=1
    iov_len=8569
    iov_buf_len=8569

The memmove read 4288 bytes from offset 4288, whereas the buffer only
had 8569 - 4288 = 4281 bytes from offset 4288. This patch fixes the
problem by adding the min(...) expression.

Signed-off-by: Li Wei <[email protected]>
Required-githooks: true
@github-actions GitHub Actions
Copy link

github-actions bot commented Sep 17, 2024 •
edited
Loading

Ticket title is 'obj_ec_singv_split may read beyond the end of iov_buf'
Status is 'In Progress'
Errors are Unknown component
https://daosio.atlassian.net/browse/DAOS-16466

@liw liw changed the title DAOS-16251 object: Fix obj_ec_singv_split overflow (#15045) DAOS-16466 object: Fix obj_ec_singv_split overflow (#15045) Sep 17, 2024
liw added 4 commits September 17, 2024 10:45
@liw
DAOS-16251 dtx: Fix dtx_req_send user-after-free (#15035)
93eee27 
In dtx_req_send, since the crt_req_send releases the req reference, din
may have been freed when dereferenced for the DL_CDEBUG call.

Signed-off-by: Li Wei <[email protected]>
Required-githooks: true
@liw
DAOS-16251 mgmt: Fix use-after-free in pool_list (#15014)
1306b2c 
In dc_mgmt_pool_list, calling wipe_cred_iov on in->pli_cred after
calling crt_req_decref on rpc is a use-after-free.

Signed-off-by: Li Wei <[email protected]>
Required-githooks: true
@liw
DAOS-16251 tests: Fix various buffer overflows (#15003)
9e77aad 
 - vos: Fix vtx_pm buffer overflow
 - vos: Fix evt_ctl stack buffer overflow
 - object: Fix srv_checksum_tests buffer overflow
 - utils: Fix ddb_vos_tests buffer overflow etc

Signed-off-by: Li Wei <[email protected]>
Required-githooks: true
@liw
DAOS-16251 engine: Misc fixes and cleanups (#14983)
a3b2e46 
- ivc_on_get stores random entry_priv_val into priv_entry for many
    ivc_ent_get implementations. Although not used, this should be
    avoided.

  - ds_iv_done stores pointer to stack variable rc in cb_info->future,
    which outlives the stack frame of ds_iv_done. Although not used,
    this pointer is confusing.

  - ds_pool_iv_map_update associates the input map buffer with the map
    version from ds_pool, rather than the input map version. Although
    this may be fine, we should really not ask for unnecessary
    trouble/concern.

Signed-off-by: Li Wei <[email protected]>
Required-githooks: true
@liw liw changed the title DAOS-16466 object: Fix obj_ec_singv_split overflow (#15045) DAOS-16466 misc: Backport fixes (#15045) Sep 17, 2024
@daosbuild1
Copy link
Collaborator

daosbuild1 commented Sep 17, 2024 •
edited by liw
Loading

Test stage NLT on EL 8.8 completed with status UNSTABLE. https://build.hpdd.intel.com/job/daos-stack/job/daos//view/change-requests/job/PR-15139/2/testReport/

[liw] https://daosio.atlassian.net/browse/DAOS-16578

@liw liw marked this pull request as ready for review September 18, 2024 00:18
@liw liw requested review from a team as code owners September 18, 2024 00:18
@liw liw requested a review from liuxuezhao September 18, 2024 00:20
@liw liw added the clean-cherry-pick Cherry-pick from another branch that did not require additional edits label Sep 18, 2024
@liw liw requested a review from a team September 18, 2024 04:41
@daltonbohning
Copy link
Contributor

FYI will need to wait until 2.6.1 GA for landings to open for 2.6.2

@gnailzenh gnailzenh merged commit 56845bd into release/2.6 Sep 20, 2024
49 of 54 checks passed
@gnailzenh gnailzenh deleted the liw/fix-ec-2.6 branch September 20, 2024 13:36
@jolivier23 jolivier23 mentioned this pull request Sep 24, 2024
Merged
daltonbohning added a commit that referenced this pull request Sep 30, 2024
@daltonbohning
Revert "DAOS-16466 misc: Backport fixes (#15045) (#15139)"
7b6dbaa 
This reverts commit 56845bd.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@gnailzenh gnailzenh gnailzenh approved these changes

@liuxuezhao liuxuezhao liuxuezhao approved these changes

Assignees
No one assigned
Labels
clean-cherry-pick Cherry-pick from another branch that did not require additional edits
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@liw @daosbuild1 @daltonbohning @liuxuezhao @gnailzenh