Commit 7fc1a8c5 authored by Madelyn Olson's avatar Madelyn Olson Committed by Oran Agra
Browse files

Prevent use after free for inbound cluster link (#11255)


(cherry picked from commit 6c03786b)
parent 8c702f8d
...@@ -813,10 +813,15 @@ void setClusterNodeToInboundClusterLink(clusterNode *node, clusterLink *link) { ...@@ -813,10 +813,15 @@ void setClusterNodeToInboundClusterLink(clusterNode *node, clusterLink *link) {
/* A peer may disconnect and then reconnect with us, and it's not guaranteed that /* A peer may disconnect and then reconnect with us, and it's not guaranteed that
* we would always process the disconnection of the existing inbound link before * we would always process the disconnection of the existing inbound link before
* accepting a new existing inbound link. Therefore, it's possible to have more than * accepting a new existing inbound link. Therefore, it's possible to have more than
* one inbound link from the same node at the same time. */ * one inbound link from the same node at the same time. Our cleanup logic assumes
* a one to one relationship between nodes and inbound links, so we need to kill
* one of the links. The existing link is more likely the outdated one, but it's
* possible the the other node may need to open another link. */
serverLog(LL_DEBUG, "Replacing inbound link fd %d from node %.40s with fd %d", serverLog(LL_DEBUG, "Replacing inbound link fd %d from node %.40s with fd %d",
node->inbound_link->conn->fd, node->name, link->conn->fd); node->inbound_link->conn->fd, node->name, link->conn->fd);
freeClusterLink(node->inbound_link);
} }
serverAssert(!node->inbound_link);
node->inbound_link = link; node->inbound_link = link;
link->node = node; link->node = node;
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment