HomeClusterLabs Projects

Fix: liblrmd: Avoid double-free during notify operation

Description

Fix: liblrmd: Avoid double-free during notify operation

This commit fixes a regression introduced by 31c7fa8a, causing a
double-free in notify operations. lrmd_dispatch_internal() assigns the
exit_reason string directly from an XML node to a new lrmd_event_data_t
object (without duplicating), and this string gets freed twice.

Free #1: pcmkcreate_history_xml() (reached via callback) calls
lrmd
set_result(), which frees event.exit_reason and sets it to NULL.
Free #2: lrmd_ipc_dispatch() frees the XML node, which contains a
pointer to the exit_reason string just freed, after
lrmd_dispatch_internal() returns.

Prior to 31c7fa8a, pcmk__create_history_xml reset event.rc and
event.op_status but not event.exit_reason.

In this commit we simply make a copy of event.exit_reason in
lrmd_dispatch_internal() before the callback. This way we don't have to
worry about whatever happens in the callback, and we can continue to
unset the exit_reason alongside the rc and op_status. The added overhead
should be minimal.

This commit also makes a copy of output. That's not strictly necessary
but adds some futureproofing and allows us to call lrmd__reset_result()
at the end of lrmd_dispatch_internal().

Resolves: RHBZ#2039675

Signed-off-by: Reid Wahl <nrwahl@protonmail.com>

Details

Provenance
nrwahl2Authored on Jan 13 2022, 5:56 AM
Parents
rPb496b98260c0: Merge pull request #2599 from clumens/metadata-output
Branches
Unknown
Tags
Unknown

Event Timeline