Fix dt_cache_get_with_caller to not crash with invalid argument - #21960
Open
victoryforce wants to merge 2 commits into
Open
Fix dt_cache_get_with_caller to not crash with invalid argument#21960victoryforce wants to merge 2 commits into
victoryforce wants to merge 2 commits into
Conversation
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The problem this PR fixes is actually happening to users, as confirmed by many issues over the years, including the latest release. Due to some yet-to-be-discovered root cause, some calls to functions that return a cache key (dt_cache_get_with_caller or dt_cache_get, which are just a wrapper to hide irrelevant arguments) pass NULL as the cache reference argument to that function.
Unprepared for the possibility of such an erroneous call, the function was not protected against this and, without checking, dereferenced the received argument, which led to a crash.
Issues: #17114, #17848, #20976, #21108, #21790.
This problem could also be the cause of crashes in other issues that described data-dependent crashes, i.e., which did not occur when running with an empty configuration. However, without a provided backtrace pointing to dt_cache_get_with_caller before the crash, it's impossible to know for sure.
What this PR does:
What this PR doesn't do:
So far, I can't even be sure if this situation can be reproduced deterministically when importing specific files whose features trigger the buggy path in the program. I can't rule out that this happens due to a race condition, for example. None of the issues I read had this information. Even where the bug reporter provided the alleged culprit files, he did not write that he tried and repeatedly got the program to crash after importing the files.
For 5.6.1, it eliminates crashes that are actually happening to users and is obviously safe.