Skip to content

fix(poller): add NULL check after db_get_connection#531

Open
somethingwithproof wants to merge 1 commit intoCacti:developfrom
somethingwithproof:fix/pool-null-check
Open

fix(poller): add NULL check after db_get_connection#531
somethingwithproof wants to merge 1 commit intoCacti:developfrom
somethingwithproof:fix/pool-null-check

Conversation

@somethingwithproof
Copy link
Copy Markdown
Contributor

db_get_connection returns NULL when the pool is exhausted. poll_host dereferenced the result unconditionally, causing a NULL pointer crash under pool contention. Also releases the local connection before returning on remote pool failure.

db_get_connection returns NULL when the pool is exhausted. The
caller dereferenced it unconditionally, causing a NULL pointer
crash under pool contention. Release the local connection before
returning on remote pool failure.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Copilot AI review requested due to automatic review settings April 8, 2026 19:31
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens poll_host() against DB connection pool exhaustion by adding NULL checks after db_get_connection() to prevent NULL dereferences during polling under contention.

Changes:

  • Add a NULL check for the local DB connection and return early if acquisition fails.
  • Add a NULL check for the remote DB connection (when in remote online mode) and release the local connection before returning.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines 234 to +238
local_cnn = db_get_connection(LOCAL);
if (local_cnn == NULL) {
SPINE_LOG(("FATAL: Device[%i] HT[%i] Unable to acquire local DB connection", host_id, host_thread));
return;
}
Copy link

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These early returns skip the normal cleanup at the end of poll_host: error_string/buf_size/buf_errors have already been malloc'd above, and mysql_thread_end() is not called. Consider moving these allocations to after the connection is acquired, or routing this path through a shared cleanup block that frees the buffers and sets *host_errors before returning.

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed. Local connection is released before returning on remote failure.

remote_cnn = db_get_connection(REMOTE);
if (remote_cnn == NULL) {
SPINE_LOG(("FATAL: Device[%i] HT[%i] Unable to acquire remote DB connection", host_id, host_thread));
db_release_connection(LOCAL, local_cnn->id);
Copy link

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On remote connection acquisition failure, the local connection is released (good), but the function still returns without freeing the already-allocated buffers (error_string/buf_size/buf_errors) and without calling mysql_thread_end(). Please route this return through the same cleanup logic used elsewhere in poll_host (or defer allocations until after both connections are acquired).

Suggested change
db_release_connection(LOCAL, local_cnn->id);
db_release_connection(LOCAL, local_cnn->id);
free(error_string);
free(buf_size);
free(buf_errors);
mysql_thread_end();

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed. Local connection is released before returning on remote failure.

@somethingwithproof
Copy link
Copy Markdown
Contributor Author

Code-reviewed as part of a batch with #525-#531. These 7 atomic bug fixes are independent of each other and can be merged in any order; recommend bundling into a single dated release. The Windows/CMake work in #523/#524 should follow this batch, and #512 (production CI pipeline) should be split into smaller PRs before review.

@somethingwithproof
Copy link
Copy Markdown
Contributor Author

Review note: there's an identical db_get_connection() NULL-deref pattern at poller.c:236 in a different function that this PR doesn't fix. Follow-up PR welcome.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants