Fix unsynchronized range over leaseCache.entries - #22129
Conversation
Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>
|
/retest |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted filessee 21 files with indirect coverage changes @@ Coverage Diff @@
## main #22129 +/- ##
==========================================
+ Coverage 69.66% 69.72% +0.05%
==========================================
Files 449 449
Lines 38177 38173 -4
==========================================
+ Hits 26597 26616 +19
+ Misses 10148 10126 -22
+ Partials 1432 1431 -1 Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ahrtr, fuweid The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/cherry-pick release-3.7 |
|
/cherry-pick release-3.6 |
|
@ahrtr: new pull request created: #22149 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@ahrtr: new pull request created: #22150 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/cherry-pick release-3.5 |
|
@ahrtr: new pull request created: #22159 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
3 participants
Fix another minor security issue (see below) related to leaseCache, which is only used by grpc-proxy.
A client of an etcd grpc-proxy started with --experimental-leasing-prefix can crash the shared proxy process. Concurrent Txn (with a range write op) and Get requests trigger a Go runtime 'fatal error: concurrent map iteration and map write' in the proxy's leasingKV singleton, terminating the proxy and denying service to every other client of that proxy.
cc @fuweid @ivanvc @serathius