backport: [links] fix memory corruption of link structure

Related to our Bugzilla #2326 [0] and upstream kronosnet report #255
[1]

[0]: https://bugzilla.proxmox.com/show_bug.cgi?id=2326
[1]: https://github.com/kronosnet/kronosnet/issues/255

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

diff --git a/debian/patches/0001-links-fix-memory-corryption-of-link-structure.patch b/debian/patches/0001-links-fix-memory-corryption-of-link-structure.patch
new file mode 100644 (file)
index 0000000..59eb358
--- /dev/null
+++ b/debian/patches/0001-links-fix-memory-corryption-of-link-structure.patch
@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Fabio M. Di Nitto" <fdinitto@redhat.com>
+Date: Thu, 19 Sep 2019 09:02:44 +0200
+Subject: [PATCH] [links] fix memory corryption of link structure
+
+the index would overflow the buffer and overwrite data in the link
+structure. Depending on what was written the cluster could fall
+apart in many ways, from crashing, to hung.
+
+Fixes: https://github.com/kronosnet/kronosnet/issues/255
+
+thanks to the proxmox developers and community for reporting the issue
+and for all the help reproducing / debugging the problem.
+
+Signed-off-by: Fabio M. Di Nitto <fdinitto@redhat.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ libknet/links.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/libknet/links.c b/libknet/links.c
+index 6abbd48..3d52511 100644
+--- a/libknet/links.c
++++ b/libknet/links.c
+@@ -62,13 +62,13 @@ int _link_updown(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id,
+       if (connected) {
+               time(&link->status.stats.last_up_times[link->status.stats.last_up_time_index]);
+               link->status.stats.up_count++;
+-              if (++link->status.stats.last_up_time_index > MAX_LINK_EVENTS) {
++              if (++link->status.stats.last_up_time_index >= MAX_LINK_EVENTS) {
+                       link->status.stats.last_up_time_index = 0;
+               }
+       } else {
+               time(&link->status.stats.last_down_times[link->status.stats.last_down_time_index]);
+               link->status.stats.down_count++;
+-              if (++link->status.stats.last_down_time_index > MAX_LINK_EVENTS) {
++              if (++link->status.stats.last_down_time_index >= MAX_LINK_EVENTS) {
+                       link->status.stats.last_down_time_index = 0;
+               }
+       }

diff --git a/debian/patches/series b/debian/patches/series
index 7fbd139c9e1647280fef36a966abac7ff97c51d7..46c26fa49a88f5846f35104a36c3c6c10584969e 100644 (file)
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,2 @@
 send-test-skip-the-SCTP-test-if-SCTP-is-not-supported-by-.patch
+0001-links-fix-memory-corryption-of-link-structure.patch