DAOS-19350 object: validate array IOD recxs#18711
Conversation
Because Object fetch tasks retain caller-owned IOD pointers, and RPC encoding may be deferred or repeated during a retry, if an asynchronous caller clears or reuses an IOD before completion, encoding can observe a positive iod_nr with a NULL iod_recxs, DAOS engine can crash in this case before it doesn't do enough defensive check. This patch includes these changes: - Reject array IODs with a positive extent count and no recx array during client validation and RPC encoding. - Add a server-side guard to prevent malformed requests from reaching VOS. Signed-off-by: Liang Zhen <gnailzenh@gmail.com>
|
Ticket title is 'repeated engine segfaults on daos_user' |
|
Test stage Build RPM on Leap 15.5 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18711/1/execution/node/335/log |
|
Test stage Build RPM on EL 8 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18711/1/execution/node/334/log |
|
Test stage Build RPM on EL 9 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18711/1/execution/node/392/log |
|
Test stage NLT on EL 8.8 completed with status UNSTABLE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net/job/daos-stack/job/daos//view/change-requests/job/PR-18711/1/testReport/ |
|
Test stage Test RPMs on Leap 15.4 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18711/1/execution/node/1253/log |
|
Test stage Test RPMs on EL 8.6 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net/job/daos-stack/job/daos/job/PR-18711/1/display/redirect |
|
Test stage Functional on EL 8.8 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net/job/daos-stack/job/daos/job/PR-18711/1/display/redirect |
1 similar comment
|
Test stage Functional on EL 8.8 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net/job/daos-stack/job/daos/job/PR-18711/1/display/redirect |
| D_GOTO(out, rc = 0); | ||
| #endif | ||
|
|
||
| if (ENCODING(proc_op) && iod->iod_type == DAOS_IOD_ARRAY && iod->iod_recxs == NULL) { |
There was a problem hiding this comment.
LGTM, but if app itself with problem that freed or reused the iod/iod_recxs, the iod_recxs possibly still is inaccessiable even when it is non NULL.
There was a problem hiding this comment.
yes, in this case it will corrupt the app buffer, but this is a bug of app itself, so the outcome if OK.
|
Test stage Build RPM on Leap 15.5 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18711/2/execution/node/333/log |
|
Test stage Build RPM on EL 8 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18711/2/execution/node/379/log |
|
Test stage Build RPM on EL 9 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18711/2/execution/node/392/log |
|
Test stage NLT on EL 8.8 completed with status UNSTABLE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net/job/daos-stack/job/daos//view/change-requests/job/PR-18711/2/testReport/ |
4 participants
Because Object fetch tasks retain caller-owned IOD pointers, and RPC encoding may be deferred or repeated during a retry, if an asynchronous caller clears or reuses an IOD before completion, encoding can observe a positive iod_nr with a NULL iod_recxs, DAOS engine can crash in this case before it doesn't do enough defensive check.
This patch includes these changes:
Reject array IODs with a positive extent count and no recx array during client validation and RPC encoding.
Add a server-side guard to prevent malformed requests from reaching VOS.
Steps for the author:
After all prior steps are complete: