sockets: fix nil pointer dereference in filterAndDestroySockets#44843
Merged
joamaki merged 1 commit intocilium:mainfrom Mar 20, 2026
Merged
sockets: fix nil pointer dereference in filterAndDestroySockets#44843joamaki merged 1 commit intocilium:mainfrom
joamaki merged 1 commit intocilium:mainfrom
Conversation
filterAndDestroySockets passes the callback result of iterateNetlinkSockets directly as sockInfo.ID without checking whether sockInfo is nil. iterateNetlinkSockets calls the callback with a nil *Socket on several error paths (receive error, wrong sender, NLMSG_ERROR), causing a SIGSEGV in the agent when netlink returns an error during socket cleanup. Guard the dereference by checking for err first and forwarding a zero-value SocketID to the caller, which already handles the error case by incrementing a failure counter and continuing. Fixes: cilium#44768 Signed-off-by: umut-polat <52835619+umut-polat@users.noreply.github.com>
Contributor
|
/test |
joamaki
approved these changes
Mar 19, 2026
Contributor
joamaki
left a comment
There was a problem hiding this comment.
Thanks for fixing. This looks good to me considering how Destroy handles it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
filterAndDestroySocketsdereferencessockInfo.IDwithout checking whethersockInfois nil.iterateNetlinkSocketscalls the callback with(nil, err)on several error paths (receive error, wrong sender,NLMSG_ERROR), causing a SIGSEGV in the agent during socket cleanup.This was observed in production when a node deletion event triggered
terminateUDPConnectionsToBackendanditerateNetlinkSocketshit a netlink error — all cilium-agent pods on the affected node pool crashed simultaneously.Fix
Check for
err != nilbefore dereferencingsockInfo, and forward a zero-valueSocketIDto the caller on error. The caller inDestroy()already handles the error by incrementing a failure counter and continuing.Fixes: #44768