On 10/14/26 4:35 PM, Eelco Chaudron via dev wrote:
>
>
> On 8 Oct 2026, at 9:47, David Marchand via dev wrote:
>
>> When a bundle transaction fails with multiple errors,
>> bundle_print_errors() crashes with SIGSEGV if an error's XID doesn't
>> match any request in the requests list.
>>
>> This happens because LIST_FOR_EACH_CONTINUE sets bmsg to NULL when it
>> exhausts the list without finding a match. On the next error iteration,
>> the list evaluation crashes with a NULL pointer dereference.
>>
>> Control message errors (TIMEOUT for OPEN_REQUEST, BAD_ID for COMMIT,
>> etc...) have XIDs that never match entries in the requests list.
>> When the bundle times out and a subsequent error is triggered, both
>> errors are collected, triggering the crash.
>>
>> Fix by checking if bmsg is NULL before entering the inner loop.
>> The existing fallback to the truncated payload from the error itself
>> handles the non-matching case correctly.
>>
>> Fixes: 506c1ddb3404 ("vconn: Better bundle error management.")
This should probably point to:
d4566085edf5 ("list: use multi-variable helpers for list loops.")
The LIST_FOR_EACH_CONTINUE didn't set the pointer to NULL before.
>> Reported-at: https://redhat.atlassian.net/browse/FDP-4392
>> Signed-off-by: David Marchand <[email protected]>
>
> The fix looks correct to me.
>
> One observation: when an XID is not found (i.e. the inner loop
> exhausts the requests list), bmsg is set to NULL, and all subsequent
> errors skip the matching loop entirely. This is pre-existing behavior;
> the patch does not change it.
>
> Acked-by: Eelco Chaudron <[email protected]>
Thanks, David and Eelco! I adjusted the Fixes tag and applied the change.
Backported down to 3.3.
Best regards, Ilya Maximets.
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
