1. 22 Feb, 2021 12 commits
    • Oran Agra's avatar
      Redis 5.0.11 · 562787e4
      Oran Agra authored
      562787e4
    • Oran Agra's avatar
    • Yossi Gottlieb's avatar
      Fix integer overflow (CVE-2021-21309). (#8522) · 48f04a82
      Yossi Gottlieb authored
      On 32-bit systems, setting the proto-max-bulk-len config parameter to a high value may result with integer overflow and a subsequent heap overflow when parsing an input bulk (CVE-2021-21309).
      
      This fix has two parts:
      
      Set a reasonable limit to the config parameter.
      Add additional checks to prevent the problem in other potential but unknown code paths.
      
      (cherry picked from commit d32f2e99)
      
      Fix MSVR reported issue.
      48f04a82
    • Viktor Söderqvist's avatar
      RM_ZsetRem: Delete key if empty (#8453) · e461f599
      Viktor Söderqvist authored
      Without this fix, RM_ZsetRem can leave empty sorted sets which are
      not allowed to exist.
      
      Removing from a sorted set while iterating seems to work (while
      inserting causes failed assetions). RM_ZsetRangeEndReached is
      modified to return 1 if the key doesn't exist, to terminate
      iteration when the last element has been removed.
      
      (cherry picked from commit aea6e71e)
      e461f599
    • Oran Agra's avatar
      fix valgrind warning created by recent pidfile fix (#8235) · 321f9872
      Oran Agra authored
      This isn't a leak, just an warning due to unreachable
      allocation on the fork child.
      Problem created by 92a483bc
      
      (cherry picked from commit 2426aaa0)
      321f9872
    • Meir Shpilraien (Spielrein)'s avatar
      Fix issue where fork process deletes the parent pidfile (#8231) · 35da4aee
      Meir Shpilraien (Spielrein) authored
      Turns out that when the fork child crashes, the crash log was deleting
      the pidfile from the disk (although the parent is still running.
      
      Now we set the pidfile of the fork process to NULL so the fork process
      will never deletes it.
      
      (cherry picked from commit 92a483bc)
      35da4aee
    • 杨博东's avatar
      Fix flock cluster config may cause failure to restart after kill -9 (#7674) · e4ab38a3
      杨博东 authored
      
      
      After fork, the child process(redis-aof-rewrite) will get the fd opened
      by the parent process(redis), when redis killed by kill -9, it will not
      graceful exit(call prepareForShutdown()), so redis-aof-rewrite thread may still
      alive, the fd(lock) will still be held by redis-aof-rewrite thread, and
      redis restart will fail to get lock, means fail to start.
      
      This issue was causing failures in the cluster tests in github actions.
      Co-authored-by: default avatarOran Agra <oran@redislabs.com>
      (cherry picked from commit cbaf3c5b)
      e4ab38a3
    • Yossi Gottlieb's avatar
      Avoid assertions when testing arm64 cow bug. (#8405) · c86eabb0
      Yossi Gottlieb authored
      At least in one case the arm64 cow kernel bug test triggers an assert, which is a problem because it cannot be ignored like cases where the bug is found.
      
      On older systems (Linux <4.5) madvise fails because MADV_FREE is not supported. We treat these failures as an indication the system is not affected.
      
      Fixes #8351, #8406
      
      (cherry picked from commit 3a504904)
      c86eabb0
    • George Prekas's avatar
      Add check for the MADV_FREE/fork arm64 Linux kernel bug (#8224) · ddf81e2f
      George Prekas authored
      
      
      Older arm64 Linux kernels have a bug that could lead to data corruption during
      background save under the following scenario:
      
      1) jemalloc uses MADV_FREE on a page,
      2) jemalloc reuses and writes the page,
      3) Redis forks the background save process, and
      4) Linux performs page reclamation.
      
      Under these conditions, Linux will reclaim the page wrongfully and the
      background save process will read zeros when it tries to read the page.
      
      The bug has been fixed in Linux with commit:
      ff1712f953e27f0b0718762ec17d0adb15c9fd0b ("arm64: pgtable: Ensure dirty bit is
      preserved across pte_wrprotect()")
      
      This Commit adds an ignore-warnings config, when not found, redis will
      print a warning and exit on startup (default behavior).
      Co-authored-by: default avatarOran Agra <oran@redislabs.com>
      (cherry picked from commit b02780c4)
      ddf81e2f
    • Yossi Gottlieb's avatar
      Fix setproctitle related crashes. (#8150) · b1242ce9
      Yossi Gottlieb authored
      Makes spt_init more careful with assumptions about what memory regions
      may be overwritten. It will now only consider a contiguous block of argv
      and envp elements and mind any gaps.
      
      (cherry picked from commit ec02c761)
      b1242ce9
    • Yossi Gottlieb's avatar
      Fix use-after-free issue in spt_copyenv. (#8088) · 86f27be3
      Yossi Gottlieb authored
      Seems to have gone unnoticed for a long time, because at least with
      glibc it will only be triggered if setenv() was called before spt_init,
      which Redis doesn't.
      
      Fixes #8064.
      
      (cherry picked from commit 7e5a6313)
      86f27be3
    • namtsui's avatar
      Avoid an out-of-bounds read in the redis-sentinel (#7443) · 47629aae
      namtsui authored
      
      
      The Redis sentinel would crash with a segfault after a few minutes
      because it tried to read from a page without read permissions. Check up
      front whether the sds is long enough to contain redis:slave or
      redis:master before memcmp() as is done everywhere else in
      sentinelRefreshInstanceInfo().
      
      Bug report and commit message from Theo Buehler. Fix from Nam Nguyen.
      Co-authored-by: default avatarNam Nguyen <namn@berkeley.edu>
      (cherry picked from commit 63dae523)
      47629aae
  2. 27 Oct, 2020 19 commits
    • Oran Agra's avatar
      Redis 5.0.10. · a767d84a
      Oran Agra authored
      a767d84a
    • Yossi Gottlieb's avatar
      Backport Lua 5.2.2 stack overflow fix. (#7733) · ee912485
      Yossi Gottlieb authored
      This fixes the issue described in CVE-2014-5461. At this time we cannot
      confirm that the original issue has a real impact on Redis, but it is
      included as an extra safety measure.
      
      (cherry picked from commit d75ad774)
      (cherry picked from commit 941174d9c9ed438f1c70dd46cddc02468614db12)
      ee912485
    • Yossi Gottlieb's avatar
      Fix wrong zmalloc_size() assumption. (#7963) · 3cf3beff
      Yossi Gottlieb authored
      When using a system with no malloc_usable_size(), zmalloc_size() assumed
      that the heap allocator always returns blocks that are long-padded.
      
      This may not always be the case, and will result with zmalloc_size()
      returning a size that is bigger than allocated. At least in one case
      this leads to out of bound write, process crash and a potential security
      vulnerability.
      
      Effectively this does not affect the vast majority of users, who use
      jemalloc or glibc.
      
      This problem along with a (different) fix was reported by Drew DeVault.
      
      (cherry picked from commit 9824fe3e)
      (cherry picked from commit ce0d74d8fdff55d07929f562ec9acf2d00caf893)
      3cf3beff
    • WuYunlong's avatar
      Add fsync to readSyncBulkPayload(). (#7839) · 54eb6649
      WuYunlong authored
      We should sync temp DB file before renaming as rdb_fsync_range does not use
      flag `SYNC_FILE_RANGE_WAIT_AFTER`.
      
      Refer to `Linux Programmer's Manual`:
      SYNC_FILE_RANGE_WAIT_AFTER
          Wait upon write-out of all pages in the range after performing any write.
      
      (cherry picked from commit 0d62caab)
      54eb6649
    • Ariel Shtul's avatar
      Fix redis-check-rdb support for modules aux data (#7826) · 77f91e09
      Ariel Shtul authored
      
      
      redis-check-rdb was unable to parse rdb files containing module aux data.
      Co-authored-by: default avatarOran Agra <oran@redislabs.com>
      (cherry picked from commit 63a05dde)
      77f91e09
    • hwware's avatar
      fix memory leak in sentinel connection sharing · d60953bf
      hwware authored
      (cherry picked from commit 1bfa2d27)
      (cherry picked from commit d3aa3791)
      d60953bf
    • Oran Agra's avatar
      Allow blocked XREAD on a cluster replica (#7881) · 89c68ba3
      Oran Agra authored
      I suppose that it was overlooked, since till recently none of the blocked commands were readonly.
      
      other changes:
      - add test for the above.
      - add better support for additional (and deferring) clients for
        cluster tests
      - improve a test which left the client in MULTI state.
      
      (cherry picked from commit 216c1106)
      89c68ba3
    • guybe7's avatar
      Modules: Invalidate saved_oparray after use (#7688) · fcda8293
      guybe7 authored
      We wanna avoid a chance of someone using the pointer in it after it'll be freed / realloced.
      
      (cherry picked from commit 65c24bd3)
      fcda8293
    • antirez's avatar
      Modules: remove spurious call from moduleHandleBlockedClients(). · cefd3392
      antirez authored
      Now we handle propagation when we free the context.
      
      (cherry picked from commit 4534960b)
      cefd3392
    • Angus Pearson's avatar
      Fix broken interval and repeat bahaviour in redis-cli (incluing cluster mode) · 10202ba1
      Angus Pearson authored
      This addresses two problems, one where infinite (negative) repeat count is broken for all types for Redis,
      and another specific to cluster mode where redirection is needed.
      
      Now allows and works correctly for negative (i.e. -1) repeat values passed with `-r` argument to redis-cli
      as documented here https://redis.io/topics/rediscli#continuously-run-the-same-command which seems to have
      regressed as a feature in 95b988 (though that commit removed bad integer wrap-around to `0` behaviour).
      
      This broken behaviour exists currently (e50458), and redis-cli will just exit immediately with repeat `-r <= 0`
      as opposed to send commands indefinitely as it should with `-r < 0`
      
      Additionally prevents a repeat * interval seconds hang/time spent doing nothing at the start before issuing
      commands in cluster mode (`-c`), where the command needed to redirect to a slot on another node, as commands
      where failing and waiting to be reissued but this was fully repeated before being reissued. For example,
      
              redis-cli -c -r 10 -i 0.5 INCR test_key_not_on_6379
      
      Would hang and show nothing for 5 seconds (10 * 0.5) before showing
      
              (integer) 1
              (integer) 2
              (integer) 3
              (integer) 4
              (integer) 5
              (integer) 6
              (integer) 7
              (integer) 8
              (integer) 9
              (integer) 10
      
      at half second intervals as intended.
      
      (cherry picked from commit 2f6ed933)
      10202ba1
    • antirez's avatar
      Cluster: introduce data_received field. · 97816fd6
      antirez authored
      We want to send pings and pongs at specific intervals, since our packets
      also contain information about the configuration of the cluster and are
      used for gossip. However since our cluster bus is used in a mixed way
      for data (such as Pub/Sub or modules cluster messages) and metadata,
      sometimes a very busy channel may delay the reception of pong packets.
      So after discussing it in #7216, this commit introduces a new field that
      is not exposed in the cluster, is only an internal information about
      the last time we received any data from a given node: we use this field
      in order to avoid detecting failures, claiming data reception of new
      data from the node is a proof of liveness.
      
      (cherry picked from commit 960186a7)
      97816fd6
    • Madelyn Olson's avatar
      Hide AUTH from monitor · 3b792f51
      Madelyn Olson authored
      partial cherry pick from 7d217547
      3b792f51
    • Guy Benoish's avatar
      Support streams in general module API functions · da2906e5
      Guy Benoish authored
      Fixes GitHub issue #6492
      Added stream support in RM_KeyType and RM_ValueLength.
      Also moduleDelKeyIfEmpty was updated, even though it has
      no effect now (It will be relevant when stream type direct
      API will be coded - i.e. RM_StreamAdd)
      
      cherry picked from commit 1833d008
      * modified to avoid adding new API to 5.0 (reverting the change to
        RM_KeyType)
      da2906e5
    • Itamar Haber's avatar
      Expands lazyfree's effort estimate to include Streams (#5794) · 18264d64
      Itamar Haber authored
      Otherwise, it is treated as a single allocation and freed synchronously. The following logic is used for estimating the effort in constant-ish time complexity:
      
      1. Check the number of nodes.
      1. Add an allocation for each consumer group registered inside the stream.
      1. Check the number of PELs in the first CG, and then add this count times the number of CGs.
      1. Check the number of consumers in the first CG, and then add this count times the number of CGs.
      
      (cherry picked from commit 5b0a06af)
      (cherry picked from commit 5a9a653f)
      18264d64
    • huangzhw's avatar
      defrag.c activeDefragSdsListAndDict when defrag sdsele, We can't use (#7492) · 918c9aa5
      huangzhw authored
      it to calculate hash, we should use newsds.
      
      (cherry picked from commit d6180c8c)
      (cherry picked from commit 7b21b8c3)
      918c9aa5
    • Oran Agra's avatar
      RESTORE ABSTTL skip expired keys - leak (#7511) · 8cc66985
      Oran Agra authored
      
      (cherry picked from commit 6a814501)
      (cherry picked from commit c4b428a3)
      8cc66985
    • Oran Agra's avatar
      RESTORE ABSTTL won't store expired keys into the db (#7472) · e9c9e4c2
      Oran Agra authored
      Similarly to EXPIREAT with TTL in the past, which implicitly deletes the
      key and return success, RESTORE should not store key that are already
      expired into the db.
      When used together with REPLACE it should emit a DEL to keyspace
      notification and replication stream.
      
      (cherry picked from commit 5977a948)
      (cherry picked from commit 95ba01b5)
      e9c9e4c2
    • Liu Zhen's avatar
      fix clusters mixing accidentally by gossip · ee4696b1
      Liu Zhen authored
      `clusterStartHandshake` will start hand handshake
      and eventually send CLUSTER MEET message, which is strictly prohibited
      in the REDIS CLUSTER SPEC.
      Only system administrator can initiate CLUSTER MEET message.
      Futher, according to the SPEC, rather than IP/PORT pairs, only nodeid
      can be trusted.
      
      (cherry picked from commit 84a7a905)
      ee4696b1
    • Guy Benoish's avatar
      XPENDING should not update consumer's seen-time · c9e370c6
      Guy Benoish authored
      Same goes for XGROUP DELCONSUMER (But in this case, it doesn't
      have any visible effect)
      
      (cherry picked from commit 3a441c7d)
      c9e370c6
  3. 24 Apr, 2020 1 commit
  4. 23 Apr, 2020 2 commits
    • yanhui13's avatar
      optimize the output of cluster slots · 7a62eb96
      yanhui13 authored
      7a62eb96
    • srzhao's avatar
      Check OOM at script start to get stable lua OOM state. · 0efb93d0
      srzhao authored
      Checking OOM by `getMaxMemoryState` inside script might get different result
      with `freeMemoryIfNeededAndSafe` at script start, because lua stack and
      arguments also consume memory.
      
      This leads to memory `borderline` when memory grows near server.maxmemory:
      
      - `freeMemoryIfNeededAndSafe` at script start detects no OOM, no memory freed
      - `getMaxMemoryState` inside script detects OOM, script aborted
      
      We solve this 'borderline' issue by saving OOM state at script start to get
      stable lua OOM state.
      
      related to issue #6565 and #5250.
      0efb93d0
  5. 17 Apr, 2020 2 commits
  6. 08 Apr, 2020 1 commit
  7. 12 Mar, 2020 2 commits
  8. 11 Mar, 2020 1 commit