lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(persist): zero nresvals_to_sched after free_name_val_list

Browse source 
Crash: encode_NameValue_list called with count=21, s=NULL on worker
rejoin, causing SIGSEGV in persist_worker_hook_fun.

Root cause: free_name_val_list(xce_name_val_t***, int) accepted count by
value. It zeroed *vals (resvals_to_sched = NULL) but could not zero
nresvals_to_sched. Any caller that freed the scheduler resource snapshot
(opget.c workerlist, reply.c clusterconf, dataex.c, sched.c dispatch)
left nresvals_to_sched stale. When the worker later rejoined and the
WAL HOOK fired, the WAL encoder read count=21 with a NULL pointer.

Fix: change signature to free_name_val_list(xce_name_val_t***, int*)
so both fields are zeroed atomically. Update all 7 call sites.
This commit is contained in:
Rongsong Shen 2026-05-20 09:39:07 +00:00
parent 0d783b16e3
commit e5fde7b55f
7 changed files with 14 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/lib/utils.c
View file

@ -385,16 +385,14 @@ int copy_strlist(xce_strlist_t* dst, xce_strlist_t src)
}
return 0;
}
void free_name_val_list(xce_name_val_t*** vals, int count)
void free_name_val_list(xce_name_val_t*** vals, int *count_p)
{
xce_name_val_t** resvals = *vals;
int count = *count_p;
int i;
if (resvals == NULL) {
return;
}
if (count <= 0) {
if (resvals == NULL || count <= 0) {
*count_p = 0;
return;
}
@ -418,7 +416,8 @@ void free_name_val_list(xce_name_val_t*** vals, int count)
}
FREEUP(resvals);
*vals = NULL;
*vals = NULL;
*count_p = 0;
}
void free_strlist(xce_strlist_t* l)