Project

General

Profile

Actions

Bug #4290

closed

dlmgmtd is careless with avl_find

Added by Robert Mustacchi about 8 years ago. Updated about 8 years ago.

Status:
Resolved
Priority:
High
Category:
cmd - userland programs
Start date:
2013-11-05
Due date:
% Done:

100%

Estimated time:
Difficulty:
Medium
Tags:
Gerrit CR:

Description

We found a dump from dlmgmtd. Looking at it Joshua Clulow had the following comments:

> ::status
debugging core file of dlmgmtd (32-bit) from ux
initial argv: /sbin/dlmgmtd
threading model: native threads
status: process terminated by SIGSEGV (Segmentation Fault), addr=30
> $C
feb4ed30 link_by_id+0x27(5, 1, 0, 0, 806a560, feb4ed80)
feb4ed50 dlmgmt_removeconf+0x21(feb4edf8, feb4ed80, feb4edac, 1, 806cf60, 0)
feb4edd0 dlmgmt_handler+0x96(0, feb4edf8, 8, 0, 0, 8054f96)
00000000 libc.so.1`__door_return+0x4b()

The result is that we die in link_by_id on account of not checking for a NULL return from avl_find. The fix is trivial – don't dereference the thing if it's NULL. All of the callers of link_by_id that I could find already check for NULL returns.

Actions #1

Updated by Robert Mustacchi about 8 years ago

  • Status changed from New to Resolved

Resolved in c6d054cbc999e5c8b9ad1aa01dbb4800b84f06bd.

Actions

Also available in: Atom PDF