[ovs-dev] [PATCH] ovsdb: transaction-forward: Fix initialization of the 'sent' hmap node.

[Ilya Maximets]

'sent_node' is initialized to all zeroes by xzalloc(), but
HMAP_NODE_NULL is not all zeroes.  hmap_node_is_null() is used
to detect if the node is valid, but it will fail and cause
segmentation fault on attempt to remove the non-existent node
from the hash map.  This can happen if client disconnected while
the transaction is not yet forwarded to the relay source:

  Program terminated with signal 11, Segmentation fault.
  0  in hmap_remove at include/openvswitch/hmap.h:293
     293         while (*bucket != node) {
  (gdb) bt
   0  hmap_remove at include/openvswitch/hmap.h:293
   1  ovsdb_txn_forward_unlist at ovsdb/transaction-forward.c:67
   2  ovsdb_txn_forward_destroy at ovsdb/transaction-forward.c:79
   3  ovsdb_trigger_destroy at ovsdb/trigger.c:70
   4  ovsdb_jsonrpc_trigger_complete at ovsdb/jsonrpc-server.c:1192
   5  ovsdb_jsonrpc_trigger_remove__  at ovsdb/jsonrpc-server.c:1204
   6  ovsdb_jsonrpc_trigger_complete_all at ovsdb/jsonrpc-server.c:1223
   7  ovsdb_jsonrpc_session_run at ovsdb/jsonrpc-server.c:546
   8  ovsdb_jsonrpc_session_run_all at ovsdb/jsonrpc-server.c:591
   9  ovsdb_jsonrpc_server_run at ovsdb/jsonrpc-server.c:406
  10  main_loop
  (gdb) print db->txn_forward_sent
  $20 = {buckets = 0x..., one = 0x0, mask = 63, n = 0}
  (gdb) print txn_fwd->sent_node
  $24 = {hash = 0, next = 0x0}

Fix that by correct initialization of the 'sent_node'.

Reported-by: Wentao Jia <wentao.jia at easystack.cn>
Reported-at: https://mail.openvswitch.org/pipermail/ovs-discuss/2021-August/051354.html
Fixes: 7964ffe7d2bf ("ovsdb: relay: Add support for transaction forwarding.")
Signed-off-by: Ilya Maximets <i.maximets at ovn.org>
---
 ovsdb/transaction-forward.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ovsdb/transaction-forward.c b/ovsdb/transaction-forward.c
index 8ff12ef4b..d15f2f1d6 100644
--- a/ovsdb/transaction-forward.c
+++ b/ovsdb/transaction-forward.c
@@ -52,6 +52,7 @@ ovsdb_txn_forward_create(struct ovsdb *db, const struct jsonrpc_msg *request)
     COVERAGE_INC(txn_forward_create);
     txn_fwd->request = jsonrpc_msg_clone(request);
     ovs_list_push_back(&db->txn_forward_new, &txn_fwd->new_node);
+    hmap_node_nullify(&txn_fwd->sent_node);
 
     return txn_fwd;
 }
-- 
2.31.1