rsyslog/rsyslog
1
0
Fork 0
mirror of https://github.com/rsyslog/rsyslog.git synced 2025-12-16 12:10:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

imjournal: fix double sd_journal_close() during thread cancellation

Browse Source 
When the main thread cancel imjournal thread, the thread exits without
setting sd_journal to NULL because sd_journal_close() contain cancel point.
This leads to a double free scenario where:

1. The thread cancel occurs during sd_journal_close()
2. The main thread then calls imjournal's afterrun function
3. sd_journal_close() is called again on the already-freed sd_journal
This commit is contained in:
xietangxin 2025-08-16 16:29:25 +08:00
parent 84491efd81
commit dc561451d7
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
plugins/imjournal/imjournal.c
View File

@ -204,11 +204,18 @@ static rsRetVal openJournal(struct journalContext_s *journalContext) {
/* trySave shoulod only be true if there is no journald error preceeding this call */
static void closeJournal(struct journalContext_s *journalContext) {
if (!journalContext->j) {
sd_journal *j_to_close = journalContext->j;
if (!j_to_close) {
LogMsg(0, RS_RET_OK_WARN, LOG_WARNING, "imjournal: closing NULL journal.\n");
} else {
journalContext->j = NULL;
/* sd_journal_close() is a cancellation point. If we are cancelled
* here, journalContext->j is already NULL, preventing double-free.
*/
sd_journal_close(j_to_close);
}
sd_journal_close(journalContext->j);
journalContext->j = NULL; /* setting to NULL here as journald API will not do that for us... */
}
static int journalGetData(struct journalContext_s *journalContext,