1. 15 10月, 2021 1 次提交
  2. 14 10月, 2021 1 次提交
  3. 13 10月, 2021 4 次提交
  4. 11 10月, 2021 2 次提交
  5. 10 10月, 2021 1 次提交
  6. 08 10月, 2021 2 次提交
  7. 07 10月, 2021 3 次提交
  8. 06 10月, 2021 5 次提交
    • A
      Implement anetPipe() to combine creating pipe and setting flags (#9511) · 2391aefd
      Andy Pan 提交于
      Implement createPipe() to combine creating pipe and setting flags, also reduce
      system calls by prioritizing pipe2() over pipe().
      
      Without createPipe(), we have to call pipe() to create a pipe and then call some
      functions (like anetCloexec() and anetNonBlock()) of anet.c to set flags respectively,
      which leads to some extra system calls, now we can leverage pipe2() to combine
      them and make the process of creating pipe more convergent in createPipe().
      Co-authored-by: NViktor Söderqvist <viktor.soderqvist@est.tech>
      Co-authored-by: NOran Agra <oran@redislabs.com>
      2391aefd
    • Y
      Test fails when flushdb triggers a bgsave (#9535) · 123cc1a1
      yoav-steinberg 提交于
      Flush db and *then* wait for the bgsave to complete.
      123cc1a1
    • Y
      Avoid argv memcpy when queuing a multi command. (#9602) · 5725088f
      yoav-steinberg 提交于
      When queuing a multi command we duplicated the argv (meaning an alloc
      and a memcpy). This isn't needed since we can use the previously allocated
      argv and just reset the client objects argv to NULL. This should saves some
      memory and is a minor optimization in heavy MULTI/EXEC traffic, especially
      if there are lots of arguments.
      5725088f
    • M
      Added module-acquire-GIL latency stats (#9608) · 4fb39b67
      Meir Shpilraien (Spielrein) 提交于
      The new value indicates how long Redis wait to
      acquire the GIL after sleep. This can help identify
      problems where a module perform some background
      operation for a long time (with the GIL held) and
      blocks the Redis main thread.
      4fb39b67
    • T
      improve latency when a client is unblocked by module timer (#9593) · f5160ed0
      tzongw 提交于
      Scenario:
      1. client block on command `XREAD BLOCK 0 STREAMS mystream  $`
      2. in a module, calling `XADD mystream * field value` via lua from a timer callback
      3. client will receive response after some latency up to 100ms
      
      Reason:
      When `XADD` signal the key `mystream` as ready, `beforeSleep` in next eventloop will call
      `handleClientsBlockedOnKeys` to unblock the client and add pending data to write but not
      actually install a write handler, so next redis will block in `aeApiPoll` up to 100ms given `hz`
      config as default 10, pending data will be sent in another next eventloop by
      `handleClientsWithPendingWritesUsingThreads`.
      
      Calling `handleClientsBlockedOnKeys` before `handleClientsWithPendingWritesUsingThreads`
      in `beforeSleep` solves the problem.
      f5160ed0
  9. 05 10月, 2021 2 次提交
  10. 04 10月, 2021 9 次提交
    • M
      Fix invalid memory write on lua stack overflow (CVE-2021-32626) (#9591) · 0f8b634c
      Meir Shpilraien (Spielrein) 提交于
      When LUA call our C code, by default, the LUA stack has room for 10
      elements. In most cases, this is more than enough but sometimes it's not
      and the caller must verify the LUA stack size before he pushes elements.
      
      On 3 places in the code, there was no verification of the LUA stack size.
      On specific inputs this missing verification could have lead to invalid
      memory write:
      1. On 'luaReplyToRedisReply', one might return a nested reply that will
         explode the LUA stack.
      2. On 'redisProtocolToLuaType', the Redis reply might be deep enough
         to explode the LUA stack (notice that currently there is no such
         command in Redis that returns such a nested reply, but modules might
         do it)
      3. On 'ldbRedis', one might give a command with enough arguments to
         explode the LUA stack (all the arguments will be pushed to the LUA
         stack)
      
      This commit is solving all those 3 issues by calling 'lua_checkstack' and
      verify that there is enough room in the LUA stack to push elements. In
      case 'lua_checkstack' returns an error (there is not enough room in the
      LUA stack and it's not possible to increase the stack), we will do the
      following:
      1. On 'luaReplyToRedisReply', we will return an error to the user.
      2. On 'redisProtocolToLuaType' we will exit with panic (we assume this
         scenario is rare because it can only happen with a module).
      3. On 'ldbRedis', we return an error.
      0f8b634c
    • O
      Fix mem leak in loading AOF, introduced by #9528 (#9582) · 9e3dca8b
      Oran Agra 提交于
      Recently merged PR introduced a leak when loading AOF files.
      This was because argv_len wasn't set, so rewriteClientCommandArgument
      would shrink the argv array and updating argc to a small value.
      9e3dca8b
    • O
      Fix protocol parsing on 'ldbReplParseCommand' (CVE-2021-32672) (#9590) · b0ca3be2
      Oran Agra 提交于
      The protocol parsing on 'ldbReplParseCommand' (LUA debugging)
      Assumed protocol correctness. This means that if the following
      is given:
      *1
      $100
      test
      The parser will try to read additional 94 unallocated bytes after
      the client buffer.
      This commit fixes this issue by validating that there are actually enough
      bytes to read. It also limits the amount of data that can be sent by
      the debugger client to 1M so the client will not be able to explode
      the memory.
      Co-authored-by: Nmeir@redislabs.com <meir@redislabs.com>
      b0ca3be2
    • O
      Fix ziplist and listpack overflows and truncations (CVE-2021-32627, CVE-2021-32628) (#9589) · c5e6a620
      Oran Agra 提交于
      - fix possible heap corruption in ziplist and listpack resulting by trying to
        allocate more than the maximum size of 4GB.
      - prevent ziplist (hash and zset) from reaching size of above 1GB, will be
        converted to HT encoding, that's not a useful size.
      - prevent listpack (stream) from reaching size of above 1GB.
      - XADD will start a new listpack if the new record may cause the previous
        listpack to grow over 1GB.
      - XADD will respond with an error if a single stream record is over 1GB
      - List type (ziplist in quicklist) was truncating strings that were over 4GB,
        now it'll respond with an error.
      Co-authored-by: Nsundb <sundbcn@gmail.com>
      c5e6a620
    • O
      Prevent unauthenticated client from easily consuming lots of memory (CVE-2021-32675) (#9588) · fba15850
      Oran Agra 提交于
      This change sets a low limit for multibulk and bulk length in the
      protocol for unauthenticated connections, so that they can't easily
      cause redis to allocate massive amounts of memory by sending just a few
      characters on the network.
      The new limits are 10 arguments of 16kb each (instead of 1m of 512mb)
      fba15850
    • O
      Fix redis-cli / redis-sential overflow on some platforms (CVE-2021-32762) (#9587) · 0215324a
      Oran Agra 提交于
      The redis-cli command line tool and redis-sentinel service may be vulnerable
      to integer overflow when parsing specially crafted large multi-bulk network
      replies. This is a result of a vulnerability in the underlying hiredis
      library which does not perform an overflow check before calling the calloc()
      heap allocation function.
      
      This issue only impacts systems with heap allocators that do not perform their
      own overflow checks. Most modern systems do and are therefore not likely to
      be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator
      which is also not vulnerable.
      Co-authored-by: NYossi Gottlieb <yossigo@gmail.com>
      0215324a
    • O
      Fix Integer overflow issue with intsets (CVE-2021-32687) (#9586) · 7cb89a5a
      Oran Agra 提交于
      The vulnerability involves changing the default set-max-intset-entries
      configuration parameter to a very large value and constructing specially
      crafted commands to manipulate sets
      7cb89a5a
    • Y
      Fix integer overflow in _sdsMakeRoomFor (CVE-2021-41099) (#9558) · 24cc0b98
      yiyuaner 提交于
      The existing overflow checks handled the greedy growing, but didn't handle
      a case where the addition of the header size is what causes the overflow.
      24cc0b98
    • Y
      improve the stability and correctness of "Test child sending info" (#9562) · 5becb7c9
      YaacovHazan 提交于
      Since we measure the COW size in this test by changing some keys and reading
      the reported COW size, we need to ensure that the "dismiss mechanism" (#8974)
      will not free memory and reduce the COW size.
      
      For that, this commit changes the size of the keys to 512B (less than a page).
      and because some keys may fall into the same page, we are modifying ten keys
      on each iteration and check for at least 50% change in the COW size.
      5becb7c9
  11. 03 10月, 2021 3 次提交
  12. 01 10月, 2021 1 次提交
  13. 30 9月, 2021 3 次提交
  14. 29 9月, 2021 2 次提交
  15. 27 9月, 2021 1 次提交