In the reported problem, AMFD crashes while trying to free invalid memory.
AMFD is trying to update value of saAmfSUAssignedSIs to IMM.
SU assignments counters saAmfSUNumCurrActiveSIs and saAmfSUNumCurrStandbySIs
reflects only active and standby HA state. If a SI is in quiesced state, it
is still assigned to this SU and su->list_of_susi will not be null. But
saAmfSUNumCurrActiveSIs will be 0.
Thus in the reported problem, no memory allocation was done
and AMFD will crash while freeing invalid memory.
Patch counts all those SUSIs which are not in unassigned fsm state in SU.
A SUSI with fsm state unassigned is getting deleted and thus not counted.
---
src/amf/amfd/su.cc | 28 ++++++++++++++++++++++++----
src/amf/amfd/su.h | 1 +
2 files changed, 25 insertions(+), 4 deletions(-)
diff --git a/src/amf/amfd/su.cc b/src/amf/amfd/su.cc
index 82bcfdb..76bd2dd 100644
--- a/src/amf/amfd/su.cc
+++ b/src/amf/amfd/su.cc
@@ -1476,16 +1476,18 @@ static SaAisErrorT su_rt_attr_cb(SaImmOiHandleT
immOiHandle,
while ((attributeName = attributeNames[i++]) != nullptr) {
if (!strcmp("saAmfSUAssignedSIs", attributeName)) {
- if (su->list_of_susi != nullptr) {
- uint32_t assigned_si =
- su->saAmfSUNumCurrActiveSIs + su->saAmfSUNumCurrStandbySIs;
+ uint32_t assigned_si =
su->count_susi_without_fsm(AVD_SU_SI_STATE_UNASGN);
+ TRACE("assigned_si:%u", assigned_si);
+ if (assigned_si != 0) {
// int size = (sizeof(SaImmAttrValueT *) * (assigned_si));
SaImmAttrValueT *attrValues = new SaImmAttrValueT[assigned_si];
SaNameT *siName = (SaNameT *)new SaNameT[assigned_si];
SaImmAttrValueT *temp = attrValues;
- int j = 0;
+ uint32_t j = 0;
for (AVD_SU_SI_REL *susi = su->list_of_susi; susi != nullptr;
susi = susi->su_next) {
+ if (susi->fsm == AVD_SU_SI_STATE_UNASGN)
+ continue;
osaf_extended_name_alloc(susi->si->name.c_str(), (siName + j));
attrValues[j] = (void *)(siName + j);
j = j + 1;
@@ -1495,6 +1497,8 @@ static SaAisErrorT su_rt_attr_cb(SaImmOiHandleT
immOiHandle,
j = 0;
for (AVD_SU_SI_REL *susi = su->list_of_susi; susi != nullptr;
susi = susi->su_next) {
+ if (susi->fsm == AVD_SU_SI_STATE_UNASGN)
+ continue;
osaf_extended_name_free(siName + j);
j = j + 1;
}
@@ -2768,3 +2772,19 @@ bool AVD_SU::restrict_auto_repair() const
return false;
}
+
+/**
+ * @brief Count number of SUSIs of this SU which are not in
+ * a given @fsm state.
+ * @param fsm state
+ * @return count
+ */
+uint32_t AVD_SU::count_susi_without_fsm(uint32_t fsm) {
+ uint32_t count = 0;
+ for (AVD_SU_SI_REL *susi = list_of_susi; susi != nullptr;
+ susi = susi->su_next) {
+ if (susi->fsm != fsm)
+ count++;
+ }
+ return count;
+}
diff --git a/src/amf/amfd/su.h b/src/amf/amfd/su.h
index 96c6b80..7884f3a 100644
--- a/src/amf/amfd/su.h
+++ b/src/amf/amfd/su.h
@@ -144,6 +144,7 @@ class AVD_SU {
uint32_t curr_num_standby_sis();
uint32_t curr_num_active_sis();
uint32_t count_susi_with(SaAmfHAStateT ha, uint32_t fsm);
+ uint32_t count_susi_without_fsm(uint32_t fsm);
bool su_any_comp_undergoing_restart_admin_op();
AVD_COMP *su_get_comp_undergoing_restart_admin_op();
bool su_all_comps_restartable();
--
1.9.1
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Opensaf-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensaf-devel
