From mboxrd@z Thu Jan  1 00:00:00 1970
From: teigland@sourceware.org <teigland@sourceware.org>
Date: 2 Oct 2007 20:40:49 -0000
Subject: [Cluster-devel] cluster/cman-kernel/src sm_message.c
Message-ID: <20071002204049.26444.qmail@sourceware.org>
List-Id: <cluster-devel.redhat.com>
To: cluster-devel.redhat.com
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

CVSROOT:	/cvs/cluster
Module name:	cluster
Branch: 	RHEL4
Changes by:	teigland at sourceware.org	2007-10-02 20:40:48

Modified files:
	cman-kernel/src: sm_message.c 

Log message:
	bz 199433
	
	The bad pointer dereferences aren't in process_messages() as the oops
	message shows, but in another function that's been inlined.  I think
	it's likely that process_leave_request() (or possibly
	process_join_request) are getting a NULL "sev" struct and using it.

Patches:
http://sourceware.org/cgi-bin/cvsweb.cgi/cluster/cman-kernel/src/sm_message.c.diff?cvsroot=cluster&only_with_tag=RHEL4&r1=1.4.2.4&r2=1.4.2.5

--- cluster/cman-kernel/src/Attic/sm_message.c	2007/08/14 17:05:10	1.4.2.4
+++ cluster/cman-kernel/src/Attic/sm_message.c	2007/10/02 20:40:47	1.4.2.5
@@ -389,6 +389,15 @@
 		 */
 
 		if (test_bit(SGFL_SEVENT, &sg->flags)) {
+
+			/* not sure how/when this happens */
+			if (!sg->sevent) {
+				log_print("process_join_request from %d "
+					  "sevent flag no struct", nodeid);
+				reply.ms_status = STATUS_NEG;
+				goto send;
+			}
+
 			sev = sg->sevent;
 
 			/*
@@ -581,6 +590,15 @@
 
 		else if (test_bit(SGFL_SEVENT, &sg->flags) &&
 			 nodeid != sm_our_nodeid) {
+
+			/* not sure how/when this happens */
+			if (!sg->sevent) {
+				log_print("process_leave_request from %d "
+					  "sevent flag no struct", nodeid);
+				reply.ms_status = STATUS_NEG;
+				goto out;
+			}
+
 			sev = sg->sevent;
 
 			/*
@@ -625,7 +643,7 @@
 		}
 
 	}
-
+ out:
 	smsg_bswap_out(&reply);
 	send_nodeid_message((char *) &reply, sizeof(reply), nodeid);
 }