7aca0be0f9
The definition of the splay_each() macro is somewhat complicated for
syntactic reasons. Here's what it does in a more readable way:
for (splay_node_t* node = tree->head; node;) {
type* item = node->data;
splay_node_t* next = node->next;
// RUN USER BLOCK with (item)
node = next;
}
list_each() works in the same way. Since node->next is saved before the
user block runs, this construct supports removing the current item from
within the user block. However, what it does *not* support is removing
*other items* from within the user block, especially the next item.
Indeed, that will invalide the next pointer in the above loop and
therefore result in an invalid pointer dereference.
Unfortunately, there is at least one code path where that unsupported
operation happens. It is located in ack_h(), where the authentication
protocol code detects a double connection (i.e. being connected to
another node twice). Running in the context of a socket read event, this
code will happily terminate the *other* metaconnection, resulting in its
socket being removed from the io tree. If, by misfortune, this other
metaconnection happened to have the next socket FD number (which is
quite possible due to FD reuse - albeit unlikely), and was part of the
io tree (which is quite likely because if that connection is stuck, it
will most likely have pending writes) then this will result in the next
pending io item being destroyed. Invalid pointer dereference ensues.
I did a quick audit of other uses of splay_each() and list_each() and
I believe this is the only scenario in which this "next pointer
invalidation" problem can occur in practice. While this bug has been
there since at least 6bc5d626a8 (November
2012), if not sooner, it happens quite rarely due to the very specific
set of conditions required to trigger it. Nevertheless, it does manage
to crash my central production nodes every other week or so.
90 lines
2.7 KiB
C
90 lines
2.7 KiB
C
/*
|
|
list.h -- header file for list.c
|
|
Copyright (C) 2000-2005 Ivo Timmermans
|
|
2000-2012 Guus Sliepen <guus@tinc-vpn.org>
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 2 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License along
|
|
with this program; if not, write to the Free Software Foundation, Inc.,
|
|
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
*/
|
|
|
|
#ifndef __TINC_LIST_H__
|
|
#define __TINC_LIST_H__
|
|
|
|
typedef struct list_node_t {
|
|
struct list_node_t *prev;
|
|
struct list_node_t *next;
|
|
|
|
/* Payload */
|
|
|
|
void *data;
|
|
} list_node_t;
|
|
|
|
typedef void (*list_action_t)(const void *);
|
|
typedef void (*list_action_node_t)(const list_node_t *);
|
|
|
|
typedef struct list_t {
|
|
list_node_t *head;
|
|
list_node_t *tail;
|
|
int count;
|
|
|
|
/* Callbacks */
|
|
|
|
list_action_t delete;
|
|
} list_t;
|
|
|
|
/* (De)constructors */
|
|
|
|
extern list_t *list_alloc(list_action_t) __attribute__ ((__malloc__));
|
|
extern void list_free(list_t *);
|
|
extern list_node_t *list_alloc_node(void);
|
|
extern void list_free_node(list_t *, list_node_t *);
|
|
|
|
/* Insertion and deletion */
|
|
|
|
extern list_node_t *list_insert_head(list_t *, void *);
|
|
extern list_node_t *list_insert_tail(list_t *, void *);
|
|
extern list_node_t *list_insert_after(list_t *, list_node_t *, void *);
|
|
extern list_node_t *list_insert_before(list_t *, list_node_t *, void *);
|
|
|
|
extern void list_delete(list_t *, const void *);
|
|
|
|
extern void list_unlink_node(list_t *, list_node_t *);
|
|
extern void list_delete_node(list_t *, list_node_t *);
|
|
|
|
extern void list_delete_head(list_t *);
|
|
extern void list_delete_tail(list_t *);
|
|
|
|
/* Head/tail lookup */
|
|
|
|
extern void *list_get_head(list_t *);
|
|
extern void *list_get_tail(list_t *);
|
|
|
|
/* Fast list deletion */
|
|
|
|
extern void list_delete_list(list_t *);
|
|
|
|
/* Traversing */
|
|
|
|
extern void list_foreach(list_t *, list_action_t);
|
|
extern void list_foreach_node(list_t *, list_action_node_t);
|
|
|
|
/*
|
|
Iterates over a list.
|
|
|
|
CAUTION: while this construct supports deleting the current item,
|
|
it does *not* support deleting *other* nodes while iterating on the list.
|
|
*/
|
|
#define list_each(type, item, list) (type *item = (type *)1; item; item = NULL) for(list_node_t *node = (list)->head, *next; item = node ? node->data : NULL, next = node ? node->next : NULL, node; node = next)
|
|
|
|
#endif /* __TINC_LIST_H__ */
|