[PATCH] Fix teamd memory corruption issues seen by missing port unlink in ifinfo_destroy()

[Samudrala, Sridhar]

This fixes teamd coredumps similar to these

systemd-coredump[11692]: Process 11345 (teamd) of user 0 dumped core.

Stack trace of thread 11345:
0  0x00007f7e6e1078d7 raise (libc.so.6)
1  0x00007f7e6e10953a abort (libc.so.6)
2  0x00007f7e6e14ada3 __libc_message (libc.so.6)
3  0x00007f7e6e1569f5 __libc_free (libc.so.6)
4  0x00007f7e6ed2779d link_free_data (libnl-route-3.so.200)
5  0x00007f7e6eafe6f0 nl_object_free (libnl-3.so.200)
6  0x00007f7e6f5a0df2 obj_input_newlink (libteam.so.5)
7  0x00007f7e6eafb0fe parse_cb (libnl-3.so.200)
8  0x00007f7e6ed2933c link_msg_parser (libnl-route-3.so.200)
9  0x00007f7e6eaf84c9 nl_cache_parse (libnl-3.so.200)
10 0x00007f7e6eafc99b nl_msg_parse (libnl-3.so.200)
11 0x00007f7e6f5a0fea ifinfo_event_handler (libteam.so.5)
12 0x00007f7e6eafdfcf nl_recvmsgs_report (libnl-3.so.200)
13 0x00007f7e6eafe339 nl_recvmsgs (libnl-3.so.200)
14 0x00007f7e6f59d8d0 cli_sock_event_handler (libteam.so.5)
15 0x00007f7e6f59e476 team_handle_events (libteam.so.5)
16 0x00000000004055d5 teamd_run_loop_run (teamd)
17 0x0000000000406a90 main (teamd)
18 0x00007f7e6e0f2fe0 __libc_start_main (libc.so.6)
19 0x000000000040755a _start (teamd)

Signed-off-by: Sridhar Samudrala <sridhar.samudrala(a)intel.com&gt;
---
 libteam/ifinfo.c       | 2 ++
 libteam/ports.c        | 8 +++++++-
 libteam/team_private.h | 1 +
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/libteam/ifinfo.c b/libteam/ifinfo.c
index afe32da..fe370e3 100644
--- a/libteam/ifinfo.c
+++ b/libteam/ifinfo.c
@@ -213,6 +213,8 @@ static struct team_ifinfo *ifinfo_find_create(struct team_handle *th,
 
 static void ifinfo_destroy(struct team_ifinfo *ifinfo)
 {
+	if (ifinfo->linked && ifinfo->port)
+		port_unlink(ifinfo->port);
 	list_del(&ifinfo->list);
 	free(ifinfo);
 }
diff --git a/libteam/ports.c b/libteam/ports.c
index 52d0c9a..9ebf30f 100644
--- a/libteam/ports.c
+++ b/libteam/ports.c
@@ -83,7 +83,8 @@ static struct team_port *port_create(struct team_handle *th,
 static void port_destroy(struct team_handle *th,
 			 struct team_port *port)
 {
-	ifinfo_unlink(port->ifinfo);
+	if (port->ifinfo)
+		ifinfo_unlink(port->ifinfo);
 	list_del(&port->list);
 	free(port);
 }
@@ -226,6 +227,11 @@ void port_list_free(struct team_handle *th)
 	flush_port_list(th);
 }
 
+void port_unlink(struct team_port *port)
+{
+	port->ifinfo = NULL;
+}
+
 /* \endcond */
 
 /**
diff --git a/libteam/team_private.h b/libteam/team_private.h
index 801f107..a07632f 100644
--- a/libteam/team_private.h
+++ b/libteam/team_private.h
@@ -105,6 +105,7 @@ int get_port_list_handler(struct nl_msg *msg, void *arg);
 int port_list_alloc(struct team_handle *th);
 int port_list_init(struct team_handle *th);
 void port_list_free(struct team_handle *th);
+void port_unlink(struct team_port *port);
 int ifinfo_event_handler(struct nl_msg *msg, void *arg);
 int ifinfo_list_alloc(struct team_handle *th);
 int ifinfo_list_init(struct team_handle *th);
-- 
2.1.0

[Samudrala, Sridhar]

Jiri,

Did you get a chance to look at this patch?
This fixes a crash we are seeing because of a race condition when ifinfo 
object gets deleted first, but port object still
has a reference to it.

Thanks
Sridhar

On 6/12/2015 12:01 PM, Sridhar Samudrala wrote:
>  This fixes teamd coredumps similar to these
>
>  systemd-coredump[11692]: Process 11345 (teamd) of user 0 dumped core.
>
>  Stack trace of thread 11345:
>  0  0x00007f7e6e1078d7 raise (libc.so.6)
>  1  0x00007f7e6e10953a abort (libc.so.6)
>  2  0x00007f7e6e14ada3 __libc_message (libc.so.6)
>  3  0x00007f7e6e1569f5 __libc_free (libc.so.6)
>  4  0x00007f7e6ed2779d link_free_data (libnl-route-3.so.200)
>  5  0x00007f7e6eafe6f0 nl_object_free (libnl-3.so.200)
>  6  0x00007f7e6f5a0df2 obj_input_newlink (libteam.so.5)
>  7  0x00007f7e6eafb0fe parse_cb (libnl-3.so.200)
>  8  0x00007f7e6ed2933c link_msg_parser (libnl-route-3.so.200)
>  9  0x00007f7e6eaf84c9 nl_cache_parse (libnl-3.so.200)
>  10 0x00007f7e6eafc99b nl_msg_parse (libnl-3.so.200)
>  11 0x00007f7e6f5a0fea ifinfo_event_handler (libteam.so.5)
>  12 0x00007f7e6eafdfcf nl_recvmsgs_report (libnl-3.so.200)
>  13 0x00007f7e6eafe339 nl_recvmsgs (libnl-3.so.200)
>  14 0x00007f7e6f59d8d0 cli_sock_event_handler (libteam.so.5)
>  15 0x00007f7e6f59e476 team_handle_events (libteam.so.5)
>  16 0x00000000004055d5 teamd_run_loop_run (teamd)
>  17 0x0000000000406a90 main (teamd)
>  18 0x00007f7e6e0f2fe0 __libc_start_main (libc.so.6)
>  19 0x000000000040755a _start (teamd)
>
>  Signed-off-by: Sridhar Samudrala <sridhar.samudrala(a)intel.com&gt;
>  ---
>    libteam/ifinfo.c       | 2 ++
>    libteam/ports.c        | 8 +++++++-
>    libteam/team_private.h | 1 +
>    3 files changed, 10 insertions(+), 1 deletion(-)
>
>  diff --git a/libteam/ifinfo.c b/libteam/ifinfo.c
>  index afe32da..fe370e3 100644
>  --- a/libteam/ifinfo.c
>  +++ b/libteam/ifinfo.c
>  @@ -213,6 +213,8 @@ static struct team_ifinfo *ifinfo_find_create(struct team_handle
> *th,
>    
>    static void ifinfo_destroy(struct team_ifinfo *ifinfo)
>    {
>  +	if (ifinfo->linked && ifinfo->port)
>  +		port_unlink(ifinfo->port);
>    	list_del(&ifinfo->list);
>    	free(ifinfo);
>    }
>  diff --git a/libteam/ports.c b/libteam/ports.c
>  index 52d0c9a..9ebf30f 100644
>  --- a/libteam/ports.c
>  +++ b/libteam/ports.c
>  @@ -83,7 +83,8 @@ static struct team_port *port_create(struct team_handle *th,
>    static void port_destroy(struct team_handle *th,
>    			 struct team_port *port)
>    {
>  -	ifinfo_unlink(port->ifinfo);
>  +	if (port->ifinfo)
>  +		ifinfo_unlink(port->ifinfo);
>    	list_del(&port->list);
>    	free(port);
>    }
>  @@ -226,6 +227,11 @@ void port_list_free(struct team_handle *th)
>    	flush_port_list(th);
>    }
>    
>  +void port_unlink(struct team_port *port)
>  +{
>  +	port->ifinfo = NULL;
>  +}
>  +
>    /* \endcond */
>    
>    /**
>  diff --git a/libteam/team_private.h b/libteam/team_private.h
>  index 801f107..a07632f 100644
>  --- a/libteam/team_private.h
>  +++ b/libteam/team_private.h
>  @@ -105,6 +105,7 @@ int get_port_list_handler(struct nl_msg *msg, void *arg);
>    int port_list_alloc(struct team_handle *th);
>    int port_list_init(struct team_handle *th);
>    void port_list_free(struct team_handle *th);
>  +void port_unlink(struct team_port *port);
>    int ifinfo_event_handler(struct nl_msg *msg, void *arg);
>    int ifinfo_list_alloc(struct team_handle *th);
>    int ifinfo_list_init(struct team_handle *th);

[Jiri Pirko]

Fri, Jun 12, 2015 at 09:01:32PM CEST, sridhar.samudrala(a)intel.com wrote:
> This fixes teamd coredumps similar to these
>
> systemd-coredump[11692]: Process 11345 (teamd) of user 0 dumped core.
>
> Stack trace of thread 11345:
> 0  0x00007f7e6e1078d7 raise (libc.so.6)
> 1  0x00007f7e6e10953a abort (libc.so.6)
> 2  0x00007f7e6e14ada3 __libc_message (libc.so.6)
> 3  0x00007f7e6e1569f5 __libc_free (libc.so.6)
> 4  0x00007f7e6ed2779d link_free_data (libnl-route-3.so.200)
> 5  0x00007f7e6eafe6f0 nl_object_free (libnl-3.so.200)
> 6  0x00007f7e6f5a0df2 obj_input_newlink (libteam.so.5)
> 7  0x00007f7e6eafb0fe parse_cb (libnl-3.so.200)
> 8  0x00007f7e6ed2933c link_msg_parser (libnl-route-3.so.200)
> 9  0x00007f7e6eaf84c9 nl_cache_parse (libnl-3.so.200)
> 10 0x00007f7e6eafc99b nl_msg_parse (libnl-3.so.200)
> 11 0x00007f7e6f5a0fea ifinfo_event_handler (libteam.so.5)
> 12 0x00007f7e6eafdfcf nl_recvmsgs_report (libnl-3.so.200)
> 13 0x00007f7e6eafe339 nl_recvmsgs (libnl-3.so.200)
> 14 0x00007f7e6f59d8d0 cli_sock_event_handler (libteam.so.5)
> 15 0x00007f7e6f59e476 team_handle_events (libteam.so.5)
> 16 0x00000000004055d5 teamd_run_loop_run (teamd)
> 17 0x0000000000406a90 main (teamd)
> 18 0x00007f7e6e0f2fe0 __libc_start_main (libc.so.6)
> 19 0x000000000040755a _start (teamd)
>
> Signed-off-by: Sridhar Samudrala <sridhar.samudrala(a)intel.com&gt; 
applied, sorry for delay.