Actions
Bug #4290
closeddlmgmtd is careless with avl_find
Start date:
2013-11-05
Due date:
% Done:
100%
Estimated time:
Difficulty:
Medium
Tags:
Gerrit CR:
External Bug:
Description
We found a dump from dlmgmtd. Looking at it Joshua Clulow had the following comments:
> ::status debugging core file of dlmgmtd (32-bit) from ux initial argv: /sbin/dlmgmtd threading model: native threads status: process terminated by SIGSEGV (Segmentation Fault), addr=30 > $C feb4ed30 link_by_id+0x27(5, 1, 0, 0, 806a560, feb4ed80) feb4ed50 dlmgmt_removeconf+0x21(feb4edf8, feb4ed80, feb4edac, 1, 806cf60, 0) feb4edd0 dlmgmt_handler+0x96(0, feb4edf8, 8, 0, 0, 8054f96) 00000000 libc.so.1`__door_return+0x4b()
The result is that we die in link_by_id on account of not checking for a NULL return from avl_find. The fix is trivial – don't dereference the thing if it's NULL. All of the callers of link_by_id that I could find already check for NULL returns.
Updated by Robert Mustacchi almost 10 years ago
- Status changed from New to Resolved
Resolved in c6d054cbc999e5c8b9ad1aa01dbb4800b84f06bd.
Actions