numam-spdk/lib
Sylvain Didelot 4cd97383cc nvme_cuse: Fix NULL pointer dereference triggered by unit test
The unit test test_nvme_cuse_stop() manually creates 2 cuse devices
and executes nvme_cuse_stop(). Problem is that the Fuse session is
never initialized for those 2 cuse devices, causing cuse_nvme_ns_stop()
to access 'ns_device->session', which is a NULL pointer.

This bug is detected by ASAN as follows:

==77298==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000180 (pc 0x7fdac6d7d40e bp 0x000000000000 sp 0x7fff74768320 T0)
==77298==The signal is caused by a READ memory access.
==77298==Hint: address points to the zero page.
    0 0x7fdac6d7d40e in fuse_session_destroy (/usr/lib64/libfuse3.so.3+0x1640e)
    1 0x40dc7a in cuse_nvme_ns_stop /home/vagrant/spdk_repo/spdk/lib/nvme/nvme_cuse.c:851
    2 0x40df59 in cuse_nvme_ctrlr_stop /home/vagrant/spdk_repo/spdk/lib/nvme/nvme_cuse.c:923
    3 0x40f103 in nvme_cuse_stop /home/vagrant/spdk_repo/spdk/lib/nvme/nvme_cuse.c:1094
    4 0x415803 in test_nvme_cuse_stop /home/vagrant/spdk_repo/spdk/test/unit/lib/nvme/nvme_cuse.c/nvme_cuse_ut.c:393
    5 0x7fdac724c1a6  (/usr/lib64/libcunit.so.1+0x41a6)
    6 0x7fdac724c528  (/usr/lib64/libcunit.so.1+0x4528)
    7 0x7fdac724d456 in CU_run_all_tests (/usr/lib64/libcunit.so.1+0x5456)
    8 0x415a4e in main /home/vagrant/spdk_repo/spdk/test/unit/lib/nvme/nvme_cuse.c/nvme_cuse_ut.c:415
    9 0x7fdac62351e1 in __libc_start_main (/usr/lib64/libc.so.6+0x281e1)
    10 0x403ddd in _start (/home/vagrant/spdk_repo/spdk/test/unit/lib/nvme/nvme_cuse.c/nvme_cuse_ut+0x403ddd)

The fix is to call fuse_session_destroy() only if the fuse session is != NULL.

Signed-off-by: Sylvain Didelot <sdidelot@ddn.com>
Change-Id: I41881243227d83e8d1e6b90e72c1b6d62ccd98d3
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/10225
Community-CI: Mellanox Build Bot
Community-CI: Broadcom CI <spdk-ci.pdl@broadcom.com>
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Aleksey Marchuk <alexeymar@mellanox.com>
Reviewed-by: Ben Walker <benjamin.walker@intel.com>
2021-11-17 10:58:50 +00:00
..
accel accel: insert freed tasks at the head of the tailq 2021-11-17 10:58:17 +00:00
bdev bdev: bdev_io_get_nvme_status() supports NVMe abort command 2021-11-17 10:58:12 +00:00
blob blob: use uint64_t for unmap and write_zeroes lba count 2021-10-14 08:17:16 +00:00
blobfs trace: move all trace definitions to a separate file 2021-10-20 07:22:00 +00:00
conf so_ver: increase all major versions 2021-02-05 14:43:47 +00:00
dma dma: Add infrstructure for push operation 2021-10-20 22:55:52 +00:00
env_dpdk env/dpdk: retry SO_RCVBUF if SO_RCVBUFFORCE fails 2021-11-08 16:05:51 +00:00
env_ocf Update ocf to 21.6 2021-10-20 07:22:22 +00:00
event thread: add spdk_poller_get_id 2021-11-16 09:06:10 +00:00
ftl ftl: fix set-but-not-used error 2021-11-03 18:30:55 +00:00
idxd idxd: free ops to the head of the tailq 2021-11-17 10:58:17 +00:00
init init: use strerror when conf file can't be loaded 2021-11-03 18:30:55 +00:00
ioat ioat: fix potential double free problem in ioat_channel_start() 2021-06-16 09:00:37 +00:00
iscsi iscsi: Merge immediate data into the following R2T data 2021-11-16 09:08:27 +00:00
json json: add the spdk_json_write_uint8|16 function 2021-10-14 09:52:25 +00:00
jsonrpc jsonrpc: use SOCK_NONBLOCK in socket() calls 2021-05-05 13:31:10 +00:00
log log: add an API to return syslog level based on SPDK's log level 2021-08-12 12:57:39 +00:00
lvol blob: use uint64_t for unmap and write_zeroes lba count 2021-10-14 08:17:16 +00:00
nbd lib/nbd: hot remove will be correctly handled 2021-07-26 08:56:23 +00:00
notify so_ver: increase all major versions 2021-02-05 14:43:47 +00:00
nvme nvme_cuse: Fix NULL pointer dereference triggered by unit test 2021-11-17 10:58:50 +00:00
nvmf nvmf/vfio-user: add a pointer to struct spdk_nvmf_ctrlr 2021-11-17 03:57:38 +00:00
rdma include: remove util.h include from queue_extras.h 2021-04-14 07:25:21 +00:00
reduce util: Add macro SPDK_SIZEOF_MEMBER to get size of a member of a struct 2021-07-15 07:16:22 +00:00
rocksdb rocksdb: fix thread name typo 2021-09-03 08:08:20 +00:00
rpc so_ver: increase all major versions 2021-02-05 14:43:47 +00:00
scsi scsi: Decide LUN format for each LUN ID 2021-10-12 09:10:18 +00:00
sock socket: Remove deprecated enable_zerocopy_send 2021-07-23 10:30:25 +00:00
thread thread: add spdk_poller_get_id 2021-11-16 09:06:10 +00:00
trace trace: enable adding relations between traces 2021-10-21 17:57:33 +00:00
trace_parser trace: enable adding relations between traces 2021-10-21 17:57:33 +00:00
ut_mock so_ver: increase all major versions 2021-02-05 14:43:47 +00:00
util add name to fd groups 2021-10-07 09:25:48 +00:00
vfio_user nvme/vfio-user: remove internal device list 2021-11-10 23:11:13 +00:00
vhost lib/vhost: Fix compilation with dpdk 21.11 2021-11-16 09:06:54 +00:00
virtio env: only pass failing address to spdk_pci_error_handler 2021-06-15 08:34:28 +00:00
vmd vmd: update for changes in IceLake platform 2021-08-31 08:39:37 +00:00
Makefile lib/trace_parser: add trace_parser library stubs 2021-09-29 08:57:58 +00:00