On 8 Oct 2026, at 9:47, David Marchand via dev wrote:
> When a bundle transaction fails with multiple errors,
> bundle_print_errors() crashes with SIGSEGV if an error's XID doesn't
> match any request in the requests list.
>
> This happens because LIST_FOR_EACH_CONTINUE sets bmsg to NULL when it
> exhausts the list without finding a match. On the next error iteration,
> the list evaluation crashes with a NULL pointer dereference.
>
> Control message errors (TIMEOUT for OPEN_REQUEST, BAD_ID for COMMIT,
> etc...) have XIDs that never match entries in the requests list.
> When the bundle times out and a subsequent error is triggered, both
> errors are collected, triggering the crash.
>
> Fix by checking if bmsg is NULL before entering the inner loop.
> The existing fallback to the truncated payload from the error itself
> handles the non-matching case correctly.
>
> Fixes: 506c1ddb3404 ("vconn: Better bundle error management.")
> Reported-at: https://redhat.atlassian.net/browse/FDP-4392
> Signed-off-by: David Marchand <[email protected]>
The fix looks correct to me.
One observation: when an XID is not found (i.e. the inner loop
exhausts the requests list), bmsg is set to NULL, and all subsequent
errors skip the matching loop entirely. This is pre-existing behavior;
the patch does not change it.
Acked-by: Eelco Chaudron <[email protected]>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
