1. 21 Jul, 2021 1 commit
    • Oran Agra's avatar
      if diskless repl child is killed, make sure to reap the pid (#7742) · 18429ce5
      Oran Agra authored
      Starting redis 6.0 and the changes we made to the diskless master to be
      suitable for TLS, I made the master avoid reaping (wait3) the pid of the
      child until we know all replicas are done reading their rdb.
      
      I did that in order to avoid a state where the rdb_child_pid is -1 but
      we don't yet want to start another fork (still busy serving that data to
      replicas).
      
      It turns out that the solution used so far was problematic in case the
      fork child was being killed (e.g. by the kernel OOM killer), in that
      case there's a chance that we currently disabled the read event on the
      rdb pipe, since we're waiting for a replica to become writable again.
      and in that scenario the master would have never realized the child
      exited, and the replica will remain hung too.
      Note that there's no mechanism to detect a hung replica while it's in
      rdb transfer state.
      
      The solution here is to add another pipe which is used by the parent to
      tell the child it is safe to exit. this mean that when the child exits,
      for whatever reason, it is safe to reap it.
      
      Besides that, i'm re-introducing an adjustment to REPLCONF ACK which was
      part of #6271 (Accelerate diskless master connections) but was dropped
      when that PR was rebased after the TLS fork/pipe changes (5a477946).
      Now that RdbPipeCleanup no longer calls checkChildrenDone, and the ACK
      has chance to detect that the child exited, it should be the one to call
      it so that we don't have to wait for cron (server.hz) to do that.
      
      (cherry picked from commit 573246f7)
      18429ce5
  2. 01 Jun, 2021 5 commits
  3. 30 May, 2021 1 commit
  4. 03 May, 2021 9 commits
    • Oran Agra's avatar
      Redis 6.0.13 · 68e93c22
      Oran Agra authored
      68e93c22
    • Oran Agra's avatar
      Resolve nonsense static analysis warnings · adf8f6f6
      Oran Agra authored
      (cherry picked from commit fd7d51c3)
      adf8f6f6
    • Oran Agra's avatar
      Fix integer overflow in STRALGO LCS (CVE-2021-29477) · 394614a5
      Oran Agra authored
      An integer overflow bug in Redis version 6.0 or newer could be exploited using
      the STRALGO LCS command to corrupt the heap and potentially result with remote
      code execution.
      
      (cherry picked from commit f0c5f920)
      394614a5
    • Oran Agra's avatar
      Fix integer overflow in intset (CVE-2021-29478) · 789f1015
      Oran Agra authored
      An integer overflow bug in Redis 6.2 could be exploited to corrupt the heap and
      potentially result with remote code execution.
      
      The vulnerability involves changing the default set-max-intset-entries
      configuration value, creating a large set key that consists of integer values
      and using the COPY command to duplicate it.
      
      The integer overflow bug exists in all versions of Redis starting with 2.6,
      where it could result with a corrupted RDB or DUMP payload, but not exploited
      through COPY (which did not exist before 6.2).
      
      (cherry picked from commit 29900d4e)
      789f1015
    • Igor's avatar
      Introduce fast path to bypass expensive serveClientsBlockedOnKeyByModule call (#8689) · 5c6f0b26
      Igor authored
      Introduce fast path to bypass expensive serveClientsBlockedOnKeyByModule call
      
      (cherry picked from commit cf0a909e)
      5c6f0b26
    • Madelyn Olson's avatar
      Skip unecessary check for pong recieved (#8585) · 8bcca06c
      Madelyn Olson authored
      
      (cherry picked from commit 98d2e001)
      8bcca06c
    • Oran Agra's avatar
      Fix crash report killed by message (#8683) · aae2d6e3
      Oran Agra authored
      We sometimes see the crash report saying we were killed by a random
      process even in cases where the crash was spontanius in redis.
      for instance, crashes found by the corrupt-dump test.
      
      It looks like this si_pid is sometimes left uninitialized, and a good
      way to tell if the crash originated in redis or trigged by outside is to
      look at si_code, real signal codes are always > 0, and ones generated by
      kill are have si_code of 0 or below.
      
      (cherry picked from commit b45b0d81)
      aae2d6e3
    • Yossi Gottlieb's avatar
      Server won't start on alpine/libmusl without IPv6. (#8655) · 94694010
      Yossi Gottlieb authored
      listenToPort attempts to gracefully handle and ignore certain errors but does not store errno prior to logging, which in turn calls several libc functions that may overwrite errno.
      
      This has been discovered due to libmusl strftime() always returning with errno set to EINVAL, which resulted with docker-library/redis#273.
      
      (cherry picked from commit df5f543b)
      94694010
    • guybe7's avatar
      Fix edge-case when a module client is unblocked (#8618) · 1b03a0d7
      guybe7 authored
      Scenario:
      1. A module client is blocked on keys with a timeout
      2. Shortly before the timeout expires, the key is being populated and signaled
         as ready
      3. Redis calls moduleTryServeClientBlockedOnKey (which replies to client) and
         then moduleUnblockClient
      4. moduleUnblockClient doesn't really unblock the client, it writes to
         server.module_blocked_pipe and only marks the BC as unblocked.
      5. beforeSleep kics in, by this time the client still exists and techincally
         timed-out. beforeSleep replies to the timeout client (double reply) and
         only then moduleHandleBlockedClients is called, reading from module_blocked_pipe
         and calling unblockClient
      
      The solution is similar to what was done in moduleTryServeClientBlockedOnKey: we
      should avoid re-processing an already-unblocked client
      
      (cherry picked from commit e58118cd)
      1b03a0d7
  5. 02 Mar, 2021 4 commits
  6. 22 Feb, 2021 12 commits
    • Oran Agra's avatar
      Redis 6.0.11 · 91ffe99e
      Oran Agra authored
      91ffe99e
    • Yossi Gottlieb's avatar
      Fix integer overflow (CVE-2021-21309). (#8522) · c9928576
      Yossi Gottlieb authored
      On 32-bit systems, setting the proto-max-bulk-len config parameter to a high value may result with integer overflow and a subsequent heap overflow when parsing an input bulk (CVE-2021-21309).
      
      This fix has two parts:
      
      Set a reasonable limit to the config parameter.
      Add additional checks to prevent the problem in other potential but unknown code paths.
      
      (cherry picked from commit d32f2e99)
      c9928576
    • Oran Agra's avatar
      Update CI on Ubuntu to tcl8.6 (since 20.04 is now used) (#8460) · 4bba84f0
      Oran Agra authored
      Github started shifting some repositoreis to use ubuntu 20.04 by default
      tcl8.5 is missing in these, but 8.6 exists in both 20.04 and 18.04
      
      (cherry picked from commit 018f7b73)
      4bba84f0
    • Viktor Söderqvist's avatar
      RM_ZsetRem: Delete key if empty (#8453) · 17c3ac89
      Viktor Söderqvist authored
      Without this fix, RM_ZsetRem can leave empty sorted sets which are
      not allowed to exist.
      
      Removing from a sorted set while iterating seems to work (while
      inserting causes failed assetions). RM_ZsetRangeEndReached is
      modified to return 1 if the key doesn't exist, to terminate
      iteration when the last element has been removed.
      
      (cherry picked from commit aea6e71e)
      17c3ac89
    • Greg Femec's avatar
      Fix random element selection for large hash tables. (#8133) · cde69883
      Greg Femec authored
      
      
      When a database on a 64 bit build grows past 2^31 keys, the underlying hash table expands to 2^32 buckets. After this point, the algorithms for selecting random elements only return elements from half of the available buckets because they use random() which has a range of 0 to 2^31 - 1. This causes problems for eviction policies which use dictGetSomeKeys or dictGetRandomKey. Over time they cause the hash table to become unbalanced because, while new keys are spread out evenly across all buckets, evictions come from only half of the available buckets. Eventually this half of the table starts to run out of keys and it takes longer and longer to find candidates for eviction. This continues until no more evictions can happen.
      
      This solution addresses this by using a 64 bit PRNG instead of libc random().
      Co-authored-by: default avatarGreg Femec <gfemec@google.com>
      (cherry picked from commit 266949c7)
      cde69883
    • Huang Zw's avatar
      Client tracking tracking-redir-broken push len is 2 not 3 (#8456) · e6a94aa5
      Huang Zw authored
      When redis responds with tracking-redir-broken push message (RESP3),
      it was responding with a broken protocol: an array of 3 elements, but only
      pushes 2 elements.
      
      (cherry picked from commit f687ac0c)
      e6a94aa5
    • filipe oliveira's avatar
      redis-benchmark: Fix broken protocol when used with -a or --dbnum (#8486) · 840b393c
      filipe oliveira authored
      Fix the pointers to the slot hash tags in the case of prefixed commands usage
      i.e. AUTH / SELECT
      
      It adjusts the pointers to the slot hash tags in the case of prefixed commands
      usage as soon as we get the 1st reply (same like we already did for the random
      strings within the command )
      
      (cherry picked from commit efccd635)
      840b393c
    • zhaozhao.zz's avatar
      XINFO should use lookupKeyReadOrReply (#8436) · 56ef0aa7
      zhaozhao.zz authored
      This bug would have let users observe logically expired keys on replicas and
      during CLIENT PAUSE WRITE.
      
      (cherry picked from commit f2a5fe36)
      56ef0aa7
    • Yossi Gottlieb's avatar
      Avoid assertions when testing arm64 cow bug. (#8405) · dcf409f8
      Yossi Gottlieb authored
      At least in one case the arm64 cow kernel bug test triggers an assert, which is a problem because it cannot be ignored like cases where the bug is found.
      
      On older systems (Linux <4.5) madvise fails because MADV_FREE is not supported. We treat these failures as an indication the system is not affected.
      
      Fixes #8351, #8406
      
      (cherry picked from commit 3a504904)
      dcf409f8
    • Yossi Gottlieb's avatar
      CONFIG REWRITE should honor umask settings. (#8371) · 1237cce6
      Yossi Gottlieb authored
      Fixes a regression introduced due to a new (safer) way of rewriting configuration files. In the past the file was simply overwritten (same inode), but now Redis creates a new temporary file and later renames it over the old one.
      
      The temp file typically gets created with 0600 permissions so we later fchmod it to fix that. Unlike open with O_CREAT, fchmod doesn't consider umask so we have to do that explicitly.
      
      Fixes #8369
      
      (cherry picked from commit b548ffab)
      1237cce6
    • guybe7's avatar
      Fix firstkey,lastkey,step in COMMAND command for some commands (#8367) · d182820f
      guybe7 authored
      The output for COMMAND command was wrong for some commands.
      clients can use firstkey,lastkey,step to find (some) key name arguments, and the
      "movablekeys" flag to know that they can't know all (or any) of the key name arguments.
      
      These commands had the wrong output:
      1. GEORADIUS*_RO used to have "movablekeys" (which it doesn't really need)
      2. XREAD and XREADGROUP used to have (1,1,1). but that's completely wrong.
      3. Z*STORE used to have (0,0,0) but it can at lest give the index of the dstkey (1,1,1)
      
      (cherry picked from commit baf92f3f)
      d182820f
    • Madelyn Olson's avatar
      Remove race condition and consistency issues with client pause and threaded IO (#8520) · 0c653428
      Madelyn Olson authored
      clientsArePaused isn't thread safe because it has a side effect of attempting to unpause,
      which may cause multiple threads concurrently updating the unblocked_clients global list.
      This change resolves this issue by no longer postponing client for threaded reads when
      clients are paused and then skipping the check for client paused for threaded reads,
      in case one is postponed and then clients are paused. (I don't think this is strictly possible,
      but being defensive seems better here)
      0c653428
  7. 12 Jan, 2021 8 commits
    • Oran Agra's avatar
      Redis 6.0.10 · 8d70d498
      Oran Agra authored
      8d70d498
    • Oran Agra's avatar
      Improve stability of new CSC eviction test (#8160) · 5745b469
      Oran Agra authored
      c4fdf09c added a test that now fails with valgrind
      it fails for two resons:
      1) the test samples the used memory and then limits the maxmemory to
         that value, but it turns out this is not atomic and on slow machines
         the background cron process that clean out old query buffers reduces
         the memory so that the setting doesn't cause eviction.
      2) the dbsize was tested late, after reading some invalidation messages
         by that time more and more keys got evicted, partially draining the
         db. this is not the focus of this fix (still a known limitation)
      
      (cherry picked from commit a102b21d)
      5745b469
    • Oran Agra's avatar
      fix race in cluster transactions test (#8312) · a11c842e
      Oran Agra authored
      we didn't wait for the commands executed on the master to reach the replica.
      
      (cherry picked from commit 4f8458d8)
      a11c842e
    • Oran Agra's avatar
      Fix cluster diskless load swapdb test (#8308) · 615eb0db
      Oran Agra authored
      The test was trying to wait for the replica to start loading the rdb
      from the master before it kills the master, but it was actually waiting
      for ROLE to be in "sync" mode, which corresponds to REPL_STATE_TRANSFER
      that starts before the actual loading starts.
      now instead it waits for the loading flag to be set.
      
      Besides, the test was dependent on the previous configuration of the
      servers, relying on the fact the replica is configured to persist
      (either RDB of AOF), now it is set explicitly.
      
      (cherry picked from commit 26495387)
      615eb0db
    • Bob Li's avatar
      Fix overflow of rdbWriteRaw return value (#8306) · 203feb6e
      Bob Li authored
      Saving string of more than 2GB to the RDB file, can result in corrupt RDB, or failure in rdbSave.
      S
      
      (cherry picked from commit 542455ce)
      203feb6e
    • guybe7's avatar
      Modules: Fix an integer sign bug in moduleTimerHandler (#8131) · 08c3f0bc
      guybe7 authored
      bug was introduced in 1a91a270
      
      (cherry picked from commit 2f41a385)
      08c3f0bc
    • Egor Seredin's avatar
      Allow '\0' inside of result of sdscatvprintf, and efficiency improvements (#6260) · 3bf02ea7
      Egor Seredin authored
      This will allow to use: RedisModule_CreateStringPrintf(ctx, "%s %c %s", "string1", 0, "string2");
      
      On large string, the previous code would incrementally retry to double the output buffer.
      now it uses the the return value of snprintf and grows to the right size in one step.
      
      and also avoids an excessive strlen in sdscat at the end.
      
      (cherry picked from commit f4ca3d87)
      3bf02ea7
    • guybe7's avatar
      Modules: Improve timer accuracy (#7987) · acb4cd21
      guybe7 authored
      The bug occurs when 'callback' re-registers itself to a point
      in the future and the execution time in non-negligible:
      'now' refers to time BEFORE callback was executed and is used
      to calculate 'next_period'.
      We must get the actual current time when calculating 'next_period'
      
      (cherry picked from commit 1a91a270)
      acb4cd21