Blame SOURCES/rsyslog-8.24.0-rhbz1632211-journal-cursor-fix.patch

ee3a35
From: Jiri Vymazal <jvymazal@redhat.com>
ee3a35
Date: Thu, 14 Mar 2019 10:58:03 +0100
ee3a35
Subject: [PATCH] Journal cursor related fixes
ee3a35
ee3a35
Added missing free() calls of received journal cursor
ee3a35
In one case there was possibility of free()'d value of journal
ee3a35
cursor not being reset, causing double-free and crash later on.
ee3a35
Not trying to get and save position of invalid journal
ee3a35
---
ee3a35
 plugins/imjournal/imjournal.c | 28 +++++----
ee3a35
 1 file changed, 15 insertions(+), 13 deletitions(-)
ee3a35
ee3a35
diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c
ee3a35
index a85e52100..f5c2be4b6 100644
ee3a35
--- a/plugins/imjournal/imjournal.c
ee3a35
+++ b/plugins/imjournal/imjournal.c
ee3a35
@@ -121,7 +121,7 @@
ee3a35
 
ee3a35
 #define J_PROCESS_PERIOD 1024  /* Call sd_journal_process() every 1,024 records */
ee3a35
 
ee3a35
-static rsRetVal persistJournalState(void);
ee3a35
+static rsRetVal persistJournalState(int trySave);
ee3a35
 static rsRetVal loadJournalState(void);
ee3a35
 
ee3a35
 static rsRetVal openJournal(sd_journal** jj) {
ee3a35
@@ -140,10 +140,10 @@
ee3a35
 	RETiRet;
ee3a35
 }
ee3a35
 
ee3a35
-static void closeJournal(sd_journal** jj) {
ee3a35
+static void closeJournal(sd_journal** jj, int trySave) {
ee3a35
 
ee3a35
 	if (cs.stateFile) { /* can't persist without a state file */
ee3a35
-		persistJournalState();
ee3a35
+		persistJournalState(trySave);
ee3a35
 	}
ee3a35
 	sd_journal_close(*jj);
ee3a35
 	j_inotify_fd = 0;
ee3a35
@@ -433,7 +434,7 @@
ee3a35
 /* This function gets journal cursor and saves it into state file
ee3a35
  */
ee3a35
 static rsRetVal
ee3a35
-persistJournalState (void)
ee3a35
+persistJournalState(int trySave)
ee3a35
 {
ee3a35
 	DEFiRet;
ee3a35
 	FILE *sf; /* state file */
ee3a35
@@ -443,12 +444,13 @@
ee3a35
 	if (cs.bWorkAroundJournalBug) {
ee3a35
 		if (!last_cursor)
ee3a35
 			ABORT_FINALIZE(RS_RET_OK);
ee3a35
-
ee3a35
-	} else if ((ret = sd_journal_get_cursor(j, &last_cursor)) < 0) {
ee3a35
-		char errStr[256];
ee3a35
-		rs_strerror_r(-(ret), errStr, sizeof(errStr));
ee3a35
-		errmsg.LogError(0, RS_RET_ERR, "sd_journal_get_cursor() failed: '%s'\n", errStr);
ee3a35
-		ABORT_FINALIZE(RS_RET_ERR);
ee3a35
+	} else if (trySave) {
ee3a35
+		if ((ret = sd_journal_get_cursor(j, &last_cursor))) {
ee3a35
+			LogError(-ret, RS_RET_ERR, "imjournal: sd_journal_get_cursor() failed");
ee3a35
+			ABORT_FINALIZE(RS_RET_ERR);
ee3a35
+		}
ee3a35
+	} else { /* not trying to get cursor out of invalid journal state */
ee3a35
+		ABORT_FINALIZE(RS_RET_OK);
ee3a35
 	}
ee3a35
 	/* we create a temporary name by adding a ".tmp"
ee3a35
 	 * suffix to the end of our state file's name
ee3a35
@@ -501,7 +506,7 @@
ee3a35
 	r = sd_journal_wait(j, POLL_TIMEOUT);
ee3a35
 
ee3a35
 	if (r == SD_JOURNAL_INVALIDATE) {
ee3a35
-		closeJournal(&j);
ee3a35
+		closeJournal(&j, 0);
ee3a35
 
ee3a35
 		iRet = openJournal(&j);
ee3a35
 		if (iRet != RS_RET_OK)
ee3a35
@@ -628,7 +634,7 @@
ee3a35
 tryRecover(void) {
ee3a35
 	errmsg.LogMsg(0, RS_RET_OK, LOG_INFO, "imjournal: trying to recover from unexpected "
ee3a35
 		"journal error");
ee3a35
-	closeJournal(&j);
ee3a35
+	closeJournal(&j, 1);
ee3a35
 	srSleep(10, 0);	// do not hammer machine with too-frequent retries
ee3a35
 	openJournal(&j);
ee3a35
 }
ee3a35
@@ -708,7 +708,7 @@
ee3a35
 		if (cs.stateFile) { /* can't persist without a state file */
ee3a35
 			/* TODO: This could use some finer metric. */
ee3a35
 			if ((count % cs.iPersistStateInterval) == 0) {
ee3a35
-				persistJournalState();
ee3a35
+				persistJournalState(1);
ee3a35
 			}
ee3a35
 		}
ee3a35
 	}
ee3a35
@@ -764,7 +764,7 @@
ee3a35
 /* close journal */
ee3a35
 BEGINafterRun
ee3a35
 CODESTARTafterRun
ee3a35
-	closeJournal(&j);
ee3a35
+	closeJournal(&j, 1);
ee3a35
 	ratelimitDestruct(ratelimiter);
ee3a35
 ENDafterRun
ee3a35
 
ee3a35