tencentcloud_ckafka_user: nil pointer dereference panic in ReadResource / DescribeUserByUserId

[kfeldmannwb]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

English

Title: tencentcloud_ckafka_user: nil pointer dereference panic in ReadResource / DescribeUserByUserId

Affected resource: tencentcloud_ckafka_user
Affected versions: At least v1.83.4; unpatched in master as of 2026-06-24

---

Description

Every terraform plan or terraform apply crashes the provider plugin with a nil pointer dereference when Terraform refreshes state for a tencentcloud_ckafka_user resource. The crash makes the provider completely unusable for any stack that contains a CKafka user.

Stack Trace

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x7398f8a]

goroutine 620 [running]:
github.com/tencentcloudstack/terraform-provider-tencentcloud/tencentcloud/services/ckafka.resourceTencentCloudCkafkaUserRead(0xc000308bd0, {0x9995140, 0xc000d6f970})
        .../tencentcloud/services/ckafka/resource_tc_ckafka_user.go:101 +0x34a

Root Cause

There are two unguarded nil pointer dereferences in the code path.

1. service_tencentcloud_ckafka.go — DescribeUserByUserId

The DescribeUser API uses SearchWord as a substring filter, not an exact-match lookup. The loop that scans the returned list dereferences item.Name without a nil check:

for _, item := range userInfoList {
    if *item.Name == user {   // PANIC if item.Name is nil
        userInfo = item
        has = true
        return
    }
}

2. resource_tc_ckafka_user.go — resourceTencentCloudCkafkaUserRead (line ~101)

Even if DescribeUserByUserId returns successfully with a non-nil userInfo, info.Name is passed directly to d.Set without a nil guard:

_ = d.Set("account_name", info.Name)   // PANIC if info.Name is nil

Either of these can trigger the crash if the CKafka API returns a user object with a nil Name field — which can occur transiently when an instance is being updated, restarted, or during eventual-consistency windows after user creation.

Suggested Fix

Add nil guards at both sites:

// In DescribeUserByUserId:
for _, item := range userInfoList {
    if item.Name == nil {
        continue
    }
    if *item.Name == user {
        userInfo = item
        has = true
        return
    }
}

// In resourceTencentCloudCkafkaUserRead:
if info.Name != nil {
    _ = d.Set("account_name", *info.Name)
}
if info.CreateTime != nil {
    _ = d.Set("create_time", info.CreateTime)
}
if info.UpdateTime != nil {
    _ = d.Set("update_time", info.UpdateTime)
}

Reproduction

1. Create a tencentcloud_ckafka_user resource against a CKafka instance.
2. Run terraform plan or terraform apply — the ReadResource refresh will trigger the panic.

Workaround

Until a fix is released, avoid the refresh by running:

terraform apply -refresh=false

---

中文

标题： tencentcloud_ckafka_user：ReadResource / DescribeUserByUserId 中发生空指针解引用 panic

受影响资源： tencentcloud_ckafka_user
受影响版本： 至少 v1.83.4；截至 2026-06-24，master 分支中该问题尚未修复

---

问题描述

每次执行 terraform plan 或 terraform apply 时，Terraform 在刷新 tencentcloud_ckafka_user 资源的状态过程中，会因空指针解引用导致 Provider 插件崩溃。该崩溃会使所有包含 CKafka 用户资源的模块完全无法使用。

崩溃堆栈

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x7398f8a]

goroutine 620 [running]:
github.com/tencentcloudstack/terraform-provider-tencentcloud/tencentcloud/services/ckafka.resourceTencentCloudCkafkaUserRead(0xc000308bd0, {0x9995140, 0xc000d6f970})
        .../tencentcloud/services/ckafka/resource_tc_ckafka_user.go:101 +0x34a

根本原因

该调用路径中存在两处未加保护的空指针解引用。

1. service_tencentcloud_ckafka.go — DescribeUserByUserId

DescribeUser API 使用 SearchWord 进行模糊（子字符串）过滤，而非精确匹配查找。遍历返回列表时，代码未对 item.Name 进行 nil 检查就直接解引用：

for _, item := range userInfoList {
    if *item.Name == user {   // 若 item.Name 为 nil，则触发 PANIC
        userInfo = item
        has = true
        return
    }
}

2. resource_tc_ckafka_user.go — resourceTencentCloudCkafkaUserRead（约第 101 行）

即使 DescribeUserByUserId 成功返回了非 nil 的 userInfo，info.Name 在传递给 d.Set 之前也未进行 nil 检查：

_ = d.Set("account_name", info.Name)   // 若 info.Name 为 nil，则触发 PANIC

当 CKafka 实例处于更新中、重启中，或在用户创建后的最终一致性窗口期内，API 可能返回 Name 字段为 nil 的用户对象，从而触发上述任一崩溃。

建议修复方案

在两处均添加 nil 保护判断：

// 在 DescribeUserByUserId 中：
for _, item := range userInfoList {
    if item.Name == nil {
        continue
    }
    if *item.Name == user {
        userInfo = item
        has = true
        return
    }
}

// 在 resourceTencentCloudCkafkaUserRead 中：
if info.Name != nil {
    _ = d.Set("account_name", *info.Name)
}
if info.CreateTime != nil {
    _ = d.Set("create_time", info.CreateTime)
}
if info.UpdateTime != nil {
    _ = d.Set("update_time", info.UpdateTime)
}

复现步骤

1. 针对某个 CKafka 实例创建一个 tencentcloud_ckafka_user 资源。
2. 执行 terraform plan 或 terraform apply——ReadResource 刷新阶段即会触发 panic。

临时规避方案

在官方修复发布之前，可通过跳过刷新来避免崩溃：

terraform apply -refresh=false