RedisLabs / redis-cluster-proxy

A proxy for Redis clusters.
GNU Affero General Public License v3.0
993 stars 132 forks source link

segfault if "PROXY MULTIPLEXING" is issued without final arg #50

Open mgravell opened 4 years ago

mgravell commented 4 years ago
127.0.0.1:7777> PROXY MULTIPLEXING
Could not connect to Redis at 127.0.0.1:7777: Connection refused

Boom!

=== PROXY BUG REPORT START: Cut & paste starting from here === [2020-04-08 15:56:51.866/0] === ASSERTION FAILED === [2020-04-08 15:56:51.866/0] ==> proxy.c:969 'p < end' is not true [2020-04-08 15:56:51.867/0] (forcing SIGSEGV to print the bug report.) [2020-04-08 15:56:51.869/0] Thread 1 terminated [2020-04-08 15:56:51.869/0] Thread 2 terminated [2020-04-08 15:56:51.870/0] Thread 3 terminated [2020-04-08 15:56:51.870/0] Thread 4 terminated [2020-04-08 15:56:51.870/0] Thread 5 terminated [2020-04-08 15:56:51.871/0] Thread 6 terminated [2020-04-08 15:56:51.872/0] Thread 7 terminated [2020-04-08 15:56:51.872/0] Redis Cluster Proxy 0.9.102 crashed by signal: 11 [2020-04-08 15:56:51.873/0] Crashed running the instruction at: 0x7f1f51010040 [2020-04-08 15:56:51.873/0] Accessing address: 0xffffffffffffffff [2020-04-08 15:56:51.873/0] Handling crash on thread: 0 [2020-04-08 15:56:51.874/0] Failed assertion: p < end (proxy.c:969)

------ STACK TRACE ------ EIP: ./redis-cluster-proxy(_proxyAssert+0x70)[0x7f1f51010040]

Backtrace: ./redis-cluster-proxy(logStackTrace+0x44)[0x7f1f5100f5a4] ./redis-cluster-proxy(sigsegvHandler+0x1a0)[0x7f1f5100fd00] /lib/x86_64-linux-gnu/libpthread.so.0(+0x12890)[0x7f1f50442890] ./redis-cluster-proxy(_proxyAssert+0x70)[0x7f1f51010040] ./redis-cluster-proxy(proxyCommand+0x1972)[0x7f1f5101be52] ./redis-cluster-proxy(processRequest+0x347)[0x7f1f5101e1b7] ./redis-cluster-proxy(readQuery+0x21e)[0x7f1f5101f45e] ./redis-cluster-proxy(aeProcessEvents+0x14f)[0x7f1f5100aadf] ./redis-cluster-proxy(aeMain+0x2b)[0x7f1f5100aeeb] ./redis-cluster-proxy(+0x1395c)[0x7f1f5101395c] /lib/x86_64-linux-gnu/libpthread.so.0(+0x76db)[0x7f1f504376db] /lib/x86_64-linux-gnu/libc.so.6(clone+0x3f)[0x7f1f5015188f]

------ INFO OUTPUT ------

Proxy

proxy_version:0.9.102 proxy_git_sha1:00000000 proxy_git_dirty:0 proxy_git_branch: os:Linux 4.4.0-19041-Microsoft x86_64 arch_bits:64 multiplexing_api:epoll gcc_version:7.3.0 process_id:344 threads:8 tcp_port:7777 uptime_in_seconds:5255 uptime_in_days:0 config_file: acl_user:default

Memory

used_memory:8333440 used_memory_human:7.95M total_system_memory:68650504192 total_system_memory_human:63.94G

Clients

connected_clients:1 max_clients:10000 thread_0_clinets:1 thread_1_clinets:0 thread_2_clinets:0 thread_3_clinets:0 thread_4_clinets:0 thread_5_clinets:0 thread_6_clinets:0 thread_7_clinets:0

Cluster

address: entry_node::0

---- SIZEOF STRUCTS ---- clientRequest: 184 client: 224 redisClusterConnection: 48 clusterNode: 112 redisCluster: 104 list: 48 listNode: 24 rax: 24 raxNode: 4 raxIterator: 480 aeEventLoop: 88 aeFileEvent: 32 aeTimeEvent: 64

------ REGISTERS ------

RAX:0000000000000000 RBX:00000000000003c9 RCX:0000000000000b40 RDX:0000000000000000 RDI:00007f1f5041c760 RSI:00007f1f5041d8c0 RBP:00007f1f5102f518 RSP:00007f1f5001fc90 R8 :00007f1f5041d8c0 R9 :00007f1f50020700 R10:00000000ffffffba R11:0000000000000000 R12:00007f1f5102f9d8 R13:00007f1f4403dc80 R14:0000000000000001 R15:00007f1f4403dc80 RIP:00007f1f51010040 EFL:0000000000010202 CSGSFS:00000053002b0033 (00007f1f5001fc9f) -> 00007fffe5808090 (00007f1f5001fc9e) -> 0000000000000000 (00007f1f5001fc9d) -> 18298df602aa7900 (00007f1f5001fc9c) -> 0000000000050200 (00007f1f5001fc9b) -> 00007f1f5102698f (00007f1f5001fc9a) -> 0000000000000007 (00007f1f5001fc99) -> 0000000000000005 (00007f1f5001fc98) -> 0000000000000000 (00007f1f5001fc97) -> 0000000000000007 (00007f1f5001fc96) -> 000000764400a7d3 (00007f1f5001fc95) -> 0000000000008006 (00007f1f5001fc94) -> 0000000000000019 (00007f1f5001fc93) -> 00007f1f5101be52 (00007f1f5001fc92) -> 00007f1f5102fadb (00007f1f5001fc91) -> 00007f1f44071e47 (00007f1f5001fc90) -> 00007f1f4403d0f1

------ DUMPING CODE AROUND EIP ------ Symbol: _proxyAssert (base: 0x7f1f5100ffd0) Module: ./redis-cluster-proxy (base 0x7f1f51000000) $ xxd -r -p /tmp/dump.hex /tmp/dump.bin $ objdump --adjust-vma=0x7f1f5100ffd0 -D -b binary -m i386:x86-64 /tmp/dump.bin

dump of function (hexdump of 240 bytes): 8b05cace220041544989fc554889f55389d385c07505e895f2ffff488d3581da0100bf0400000031c0e8e21a0000488d3587da01004d89e089d94889eabf0400000031c0e8c71a0000488d3590d70100bf0400000031c04c89256ace220048892d5bce2200891d4dcc2200e8a01a0000c60425ffffffff785b5d415cc30f1f0048b8feffffffffffff7f4154554839c65348bb0000000000000080771b4883fe04bb0400000076100f1f8400000000004801db4839de77f848395f18b80100000074394889fd488d3cdd000000004c8d63ffe80969010048837d1000742a4889453048895d3831c04c89654048c74548 Function at 0x7f1f51011ae0 is proxyLog Function at 0x7f1f510269b0 is zcalloc

=== PROXY BUG REPORT END. Make sure to include from START to END. ===

artix75 commented 4 years ago

Fixed in ac83840