Prechádzať zdrojové kódy

Unlink shm buffers if init fails

If ipc init failed, buffers was not unlinked nether by client (lib) side
nor server (corosync) side. This may lead to fill all available space,
resulting in no accept of other connection. Typical example can be user
running any corosync ipc binary (like corosync-objctl), without correct
uid/gid entry in corosync configuration, resulting in DOS.

Signed-off-by: Jan Friesse <jfriesse@redhat.com>
Reviewed-by: Steven Dake <sdake@redhat.com>
Jan Friesse 14 rokov pred
rodič
commit
ab83b695b5
1 zmenil súbory, kde vykonal 5 pridanie a 1 odobranie
  1. 5 1
      lib/coroipcc.c

+ 5 - 1
lib/coroipcc.c

@@ -752,7 +752,7 @@ coroipcc_service_connect (
 
 
 	ipc_instance->fd = request_fd;
 	ipc_instance->fd = request_fd;
 
 
-	if (path_data->res_setup.error == CS_ERR_TRY_AGAIN) {
+	if (path_data->res_setup.error != CS_OK) {
 		res = path_data->res_setup.error;
 		res = path_data->res_setup.error;
 		goto error_exit;
 		goto error_exit;
 	}
 	}
@@ -776,12 +776,16 @@ error_exit:
 		semctl (ipc_instance->control_buffer->semid, 0, IPC_RMID);
 		semctl (ipc_instance->control_buffer->semid, 0, IPC_RMID);
 #endif
 #endif
 	memory_unmap (ipc_instance->dispatch_buffer, dispatch_size);
 	memory_unmap (ipc_instance->dispatch_buffer, dispatch_size);
+	unlink (path_data->dispatch_map_path);
 error_dispatch_buffer:
 error_dispatch_buffer:
 	memory_unmap (ipc_instance->response_buffer, response_size);
 	memory_unmap (ipc_instance->response_buffer, response_size);
+	unlink (path_data->response_map_path);
 error_response_buffer:
 error_response_buffer:
 	memory_unmap (ipc_instance->request_buffer, request_size);
 	memory_unmap (ipc_instance->request_buffer, request_size);
+	unlink (path_data->request_map_path);
 error_request_buffer:
 error_request_buffer:
 	memory_unmap (ipc_instance->control_buffer, 8192);
 	memory_unmap (ipc_instance->control_buffer, 8192);
+	unlink (path_data->control_map_path);
 error_connect:
 error_connect:
 	close (request_fd);
 	close (request_fd);