Re: snmpd [10/16]: Make retries on open session where connection is closed return early

[Theo Buehler]

On Tue, Oct 17, 2023 at 03:13:57PM +0200, Martijn van Duren wrote:
> Here's a special case unlikely to be found in the wild:
> When opening 2 sessions on an agentx connection (already unusual) and
> registering 2 overlapping regions on the different sessions, e.g. by
> differing in priority (even more unusual) and we close the underlying
> connection with an outstanding request to the dominant region we will
> call appl_agentx_free(), which sequentially closes all sessions.
> If the session with the outstanding request is closed before the
> second session the request is retried before said session is cleaned
> up and it will try to send it over a conn_ax which at that point has
> been set to NULL, resulting in a SIGSEGV.
> 
> Simply return early and let this second request be cancelled by the
> cleanup of the second session.

Makes total sense.

ok tb

snmpd [10/16]: Make retries on open session where connection is closed return early

[Martijn van Duren]

Here's a special case unlikely to be found in the wild:
When opening 2 sessions on an agentx connection (already unusual) and
registering 2 overlapping regions on the different sessions, e.g. by
differing in priority (even more unusual) and we close the underlying
connection with an outstanding request to the dominant region we will
call appl_agentx_free(), which sequentially closes all sessions.
If the session with the outstanding request is closed before the
second session the request is retried before said session is cleaned
up and it will try to send it over a conn_ax which at that point has
been set to NULL, resulting in a SIGSEGV.

Simply return early and let this second request be cancelled by the
cleanup of the second session.

OK?

martijn@

diff --git a/application_agentx.c b/application_agentx.c
index 2231d4c..680725d 100644
--- a/application_agentx.c
+++ b/application_agentx.c
@@ -712,6 +712,9 @@ appl_agentx_get(struct appl_backend *backend, int32_t 
transactionid,
struct ax_searchrange *srl;
size_t i, j, nsr;
 
+   if (session->sess_conn->conn_ax == NULL)
+   return;
+
for (nsr = 0, vb = vblist; vb != NULL; vb = vb->av_next)
nsr++;
 
@@ -760,6 +763,9 @@ appl_agentx_getnext(struct appl_backend *backend, int32_t 
transactionid,
struct ax_searchrange *srl;
size_t i, j, nsr;
 
+   if (session->sess_conn->conn_ax == NULL)
+   return;
+
for (nsr = 0, vb = vblist; vb != NULL; vb = vb->av_next)
nsr++;