From: Andrew Deason Date: Fri, 28 Dec 2012 17:58:33 +0000 (-0500) Subject: viced: Avoid dangling uuid hash table entry X-Git-Tag: upstream/1.6.3^2~58 X-Git-Url: https://git.michaelhowe.org/gitweb/?a=commitdiff_plain;h=3b26eb76a37fb858672d2bb59589086d230d7959;p=packages%2Fo%2Fopenafs.git viced: Avoid dangling uuid hash table entry Currently we add a given host to the uuid hash table, then call RXAFS_InitCallBackState3, and then only initialize the host->interface structure if the ICBS3 call succeeded. If the ICBS3 call fails, we have added a host to the uuid hash table, but the host structure does not contain that uuid. If the host is then deleted, we will not remove the host from the uuid hash table (since host->interface is NULL), and so the uuid hash table entry will still point to the freed host. If that host is then later looked up via that uuid, we can reference a freed host, which can cause all kinds of undefined behavior. So instead, add the host to the uuid hash table at the same time that we initialize the host->interface structure, inside initInterfaceAddr_r. FIXES 131277 Reviewed-on: http://gerrit.openafs.org/8846 Reviewed-by: Derrick Brashear Tested-by: BuildBot (cherry picked from commit 7b642173c7cd7b6b7130214c1a940501736abbf0) Change-Id: I838b55244a9745dd07b7d633cb3091414162b0d5 Reviewed-on: http://gerrit.openafs.org/8868 Tested-by: Andrew Deason Tested-by: Derrick Brashear Reviewed-by: Derrick Brashear Reviewed-by: Andrew Deason Reviewed-by: Stephan Wiesand --- diff --git a/src/viced/host.c b/src/viced/host.c index 71cad29b6..d79e7d838 100644 --- a/src/viced/host.c +++ b/src/viced/host.c @@ -2184,7 +2184,6 @@ h_GetHost_r(struct rx_connection *tcon) /* the new host is held and locked */ } else { /* This really is a new host */ - h_AddHostToUuidHashTable_r(&identP->uuid, host); cb_conn = host->callback_rxcon; rx_GetConnection(cb_conn); H_UNLOCK; @@ -4185,6 +4184,8 @@ initInterfaceAddr_r(struct host *host, struct interfaceAddr *interf) osi_Assert(!host->interface); host->interface = interface; + h_AddHostToUuidHashTable_r(&interface->uuid, host); + if (LogLevel >= 125) { afsUUID_to_string(&interface->uuid, uuidstr, 127);