mempool Memory out of bounds

[feizai131]

Description of problem:
access memory size is NPOOLS ，but pool_list->pools[i]. size is NPOOLS -1
mem_get_pool_list(void)
{
...................
. .....................
if (!pool_list) {
pool_list = MALLOC(pool_list_size);
if (!pool_list) {
return NULL;
}

    INIT_LIST_HEAD(&pool_list->thr_list);
    (void)pthread_spin_init(&pool_list->lock, PTHREAD_PROCESS_PRIVATE);
    for (i = 0; i < NPOOLS; ++i) {
        pool_list->pools[i].parent = &pools[i];
        pool_list->pools[i].hot_list = NULL;
        pool_list->pools[i].cold_list = NULL;

size
mem_pools_preinit(void)
{
unsigned int i;

INIT_LIST_HEAD(&pool_threads);
INIT_LIST_HEAD(&pool_free_threads);

for (i = 0; i < NPOOLS; ++i) {
    pools[i].power_of_two = POOL_SMALLEST + i;
}

pool_list_size = sizeof(per_thread_pool_list_t) +
                 sizeof(per_thread_pool_t) * (NPOOLS - 1);

init_done = GF_MEMPOOL_INIT_EARLY;

}

pool_list->pools[i] is NPOOLS - 1,but the for (i = 0; i < NPOOLS; ++i) is NPOOLS . Memory out of bounds
The exact command to reproduce the issue:

The full output of the command that failed:

Expected results:

Mandatory info:
- The output of the gluster volume info command:

- The output of the gluster volume status command:

- The output of the gluster volume heal command:

**- Provide logs present on following locations of client and server nodes -
/var/log/glusterfs/

**- Is there any crash ? Provide the backtrace and coredump

Additional info:

- The operating system / glusterfs version:

Note: Please hide any confidential data which you don't want to share in public like IP address, file name, hostname or any other configuration

[mohit84]

After release 10 by default, mempool is disabled so a user will not face this issue. The user will face the issue only while using mempool, you are correct we need to solve it. I have to check from which patch the condition was changed, I don't think we had this issue earlier before moving on tcmalloc.

[feizai131]

Why not use mempool? Are you experiencing performance bottlenecks ？

[mohit84]

Yes , after using tcmalloc we were seeing good performance improvement. The mempool performance was good with glibc based allocation api(malloc|calloc) not with tcmalloc. After using tcmalloc the performance was decreased so we disabled mempool. For more please refer to the issue (#2771).

[mohit84]

I have checked the history, the mempool is out of bounds because the array size changed by the patch (#3411), Before the patch per_thread_pool_list has single element array so it
was working fine. We need to revert it to avoid the same.

[mykaul]

Yet another reason to remove mempool altogether. Untested path leads to bugs.