about summary refs log tree commit homepage
tag namev1.3.1 (2596ce9cec35b0cca8a2752ca0a188af38ff0d3b)
tag date2013-10-12 21:45:46 +0000
tagged byEric Wong <normalperson@yhbt.net>
tagged objectcommit b7bda87ead...
downloadcmogstored-1.3.1.tar.gz
cmogstored 1.3.1 - fix for an undocumented feature
This release fixes a bug which only affects users of the
undocumented multi-process configuration feature
(which is also multi-threaded).

* avoid use-after-free with multi-process setups

  readdir on the same DIR pointer is undefined if DIR was inherited by
  multiple children.  Using the reentrant readdir_r would not have
  helped, since the underlying file descriptor and kernel file handle
  were still shared (and we need rewinddir, too).

  This readdir usage bug existed in cmogstored since the earliest
  releases, but was harmless until the cmogstored 1.3 series.

  This misuse of readdir lead to hitting a leftover call to free().
  So this bug only manifested since
  commit 1fab1e7a7f03f3bc0abb1b5181117f2d4605ce3b
  (svc: implement top-level by_mog_devid hash)

  Fortunately, these bugs only affect users of the undocumented
  multi-process feature (not just multi-threaded).