Fix #12203: return NULL after flb_worker_context_create failure in flb_log_create - #12274
Fix #12203: return NULL after flb_worker_context_create failure in flb_log_create#12274MsfPablo wants to merge 1 commit into
Conversation
… in flb_log_create When flb_worker_context_create() returns NULL, flb_log_create() freed log and continued execution, leading to a NULL deref in flb_log_worker_init() and a use-after-free when log_cache creation failed. Return NULL immediately after cleanup so the rest of the function is only reached when both log and worker are valid. Co-Authored-By: Claude <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5df14a02e2
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| mk_event_loop_destroy(log->evl); | ||
| flb_free(log); | ||
| config->log = NULL; | ||
| return NULL; |
There was a problem hiding this comment.
When flb_worker_context_create() fails after the logger pipe, metrics, mutexes, and possibly the file sink have already been initialized, this new return NULL leaves those resources behind and clears config->log, so later flb_config_exit() cannot call flb_log_destroy() to clean them up. In startup or embedded callers that retry after a transient allocation failure, each failed attempt leaks the pipe descriptors, cmetrics state, and an open log file when FLB_LOG_FILE was selected; this failure path should mirror the relevant pre-thread cleanup before returning.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
^ @MsfPablo We need to release resources on exceptions.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthrough
ChangesLog creation error handling
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
| mk_event_loop_destroy(log->evl); | ||
| flb_free(log); | ||
| config->log = NULL; | ||
| return NULL; |
There was a problem hiding this comment.
^ @MsfPablo We need to release resources on exceptions.
3 participants
Fixes #12203
When
flb_worker_context_create()fails insideflb_log_create(), theexisting code destroyed
log->evl, freedlog, setconfig->log = NULL,but then continued execution. The subsequent
flb_log_worker_init(worker)call receives
worker == NULLand either dereferences NULL (when the cacheis created) or reads the freed
log->evl(when cache creation also fails).Add
return NULL;immediately after the cleanup so the rest of the functionis reachable only when both
logandworkerare valid.Severity: Low — OOM-only availability bug.
🤖 Generated with Claude Code
Summary by CodeRabbit