You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The above if check will log extension launch failure and signal shutdown, but does not include an early return. As a result, an empty std::shared_ptr<PlatformProcess> is added to the watcher's extension map, which the crashing thread later chokes on since it's not anticipating nulls to be in the map.
Seems like a simple one liner fix:
if (ext_process == nullptr) {
// Unrecoverable error, cannot create an extension process.
LOG(ERROR) << "Cannot create extension process: " << extension;
requestShutdown(EXIT_FAILURE);
return; // Don't pollute the watcher's extension map with a bad entry.
}
The text was updated successfully, but these errors were encountered:
Bug report
What operating system and version are you using?
Windows, crash most often seen on Server 2022, but seen on client versions of Win10 as well.
What version of osquery are you using?
5.11.0
What steps did you take to reproduce the issue?
Crash seen occasionally in automation runs (~ once every 1-3 days).
What did you expect to see?
No crash
What did you see instead?
Crash, with call stack:
The main thread is currently in the middle of waiting for shutdown after launching the above crashing thread to shutdown extensions:
Issue appears to be due to the following:
osquery/osquery/core/watcher.cpp
Lines 758 to 770 in fcbb368
The above
if
check will log extension launch failure and signal shutdown, but does not include an early return. As a result, an emptystd::shared_ptr<PlatformProcess>
is added to the watcher's extension map, which the crashing thread later chokes on since it's not anticipating nulls to be in the map.Seems like a simple one liner fix:
The text was updated successfully, but these errors were encountered: