Fix nil pointer dereference in NRI GetIPs#13683
Conversation
There was a problem hiding this comment.
Pull request overview
This PR hardens the NRI CRI pod sandbox wrapper against a teardown/race scenario by preventing a nil pointer dereference when computing IP addresses from a criPodSandbox whose embedded *sstore.Sandbox may be nil.
Changes:
- Add a nil guard in
(*criPodSandbox).GetIPs()before accessing promoted fields from the embedded*Sandbox. - Add Linux-scoped unit tests covering nil sandbox, empty primary IP, and populated primary/additional IP cases.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| internal/cri/nri/nri_api_linux.go | Adds p.Sandbox == nil guard in GetIPs() to avoid nil dereference during teardown/races. |
| internal/cri/nri/nri_api_linux_test.go | Adds unit tests validating GetIPs() behavior for nil/empty/populated IP inputs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
github-project-automation
Bot
moved this from Needs Triage
to Review In Progress
in Pull Request Review
samuelkarp
left a comment
samuelkarp
left a comment
There was a problem hiding this comment.
Can you add the comment that @AkihiroSuda suggested?
60623bd to
1668da1
Compare
Adds a nil guard to GetIPs on criPodSandbox before accessing promoted struct fields on the embedded Sandbox pointer. During pod sandbox teardown or race conditions during container exit events, nriPodSandbox can return a criPodSandbox instance where the embedded Sandbox pointer is nil. Assisted-by: Antigravity Signed-off-by: Chris Henzie <[email protected]>
1668da1 to
c2dae31
Compare
github-project-automation
Bot
moved this from Review In Progress
to Done
in Pull Request Review
|
/cherry-pick release/2.3 |
|
@chrishenzie: new pull request created: #13695 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@chrishenzie: new pull request created: #13696 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@chrishenzie: new pull request created: #13697 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
chrishenzie
added
cherry-pick/2.1.x
Adds a
nilguard toGetIPsoncriPodSandboxbefore accessing promoted struct fields on the embeddedSandboxpointer.During pod sandbox teardown or race conditions during container exit events,
nriPodSandboxcan return acriPodSandboxinstance where the embeddedSandboxpointer isnil.Assisted-by: Antigravity