public inbox for glibc-bugs@sourceware.org help / color / mirror / Atom feed
* [Bug nis/13761] New: [PATCH] Fix allocation in nss_compat for large number of memberships to a group @ 2012-02-27 6:10 siddhesh at redhat dot com 2012-02-27 6:17 ` [Bug nis/13761] " siddhesh at redhat dot com ` (8 more replies) 0 siblings, 9 replies; 10+ messages in thread From: siddhesh at redhat dot com @ 2012-02-27 6:10 UTC (permalink / raw) To: glibc-bugs http://sourceware.org/bugzilla/show_bug.cgi?id=13761 Bug #: 13761 Summary: [PATCH] Fix allocation in nss_compat for large number of memberships to a group Product: glibc Version: unspecified Status: NEW Severity: normal Priority: P2 Component: nis AssignedTo: unassigned@sourceware.org ReportedBy: siddhesh@redhat.com CC: kukuk@suse.de Classification: Unclassified nss_compat allocates buffer space on stack using alloca (and extend_alloca) for initgroup and keeps extending it to fit in larger lines. This breaks for cases where the number of members in a gorup are very large, causing the alloca reference to go beyond thread stack boundary. I have posted a patch on libc-alpha that implements a fallback to malloc/free if the buffer size needed is beyond __libc_alloca_cutoff: http://sourceware.org/ml/libc-alpha/2012-02/msg00503.html How reproducible: Always Steps to Reproduce: 1. In /etc/nsswitch.conf: group: compat group_compat: files 2. Create a large number of users for a single group for i in $(seq 1 70000); do useradd -M -N -s /sbin/nologin -G foo somelongusernameaaaaaaaaaaaa$i echo Created somelongusername$i done 3. Start nscd 4. groups somelongusernameaaaaaaaaaaaa100 Actual results: nscd crashes Expected results: nscd does not crash Additional info: This is also possible with ldap (the original case is with ldap): group: files compat group_compat: ldap -- Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 10+ messages in thread
* [Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group 2012-02-27 6:10 [Bug nis/13761] New: [PATCH] Fix allocation in nss_compat for large number of memberships to a group siddhesh at redhat dot com @ 2012-02-27 6:17 ` siddhesh at redhat dot com 2012-02-28 3:39 ` carlos at systemhalted dot org ` (7 subsequent siblings) 8 siblings, 0 replies; 10+ messages in thread From: siddhesh at redhat dot com @ 2012-02-27 6:17 UTC (permalink / raw) To: glibc-bugs http://sourceware.org/bugzilla/show_bug.cgi?id=13761 --- Comment #1 from Siddhesh Poyarekar <siddhesh at redhat dot com> 2012-02-27 06:16:45 UTC --- Updated patch here: http://sourceware.org/ml/libc-alpha/2012-02/msg00664.html -- Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 10+ messages in thread
* [Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group 2012-02-27 6:10 [Bug nis/13761] New: [PATCH] Fix allocation in nss_compat for large number of memberships to a group siddhesh at redhat dot com 2012-02-27 6:17 ` [Bug nis/13761] " siddhesh at redhat dot com @ 2012-02-28 3:39 ` carlos at systemhalted dot org 2012-02-28 3:43 ` carlos at systemhalted dot org ` (6 subsequent siblings) 8 siblings, 0 replies; 10+ messages in thread From: carlos at systemhalted dot org @ 2012-02-28 3:39 UTC (permalink / raw) To: glibc-bugs http://sourceware.org/bugzilla/show_bug.cgi?id=13761 Carlos O'Donell <carlos at systemhalted dot org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |carlos at systemhalted dot | |org Flags| |examined?(carlos at | |systemhalted dot org) -- Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 10+ messages in thread
* [Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group 2012-02-27 6:10 [Bug nis/13761] New: [PATCH] Fix allocation in nss_compat for large number of memberships to a group siddhesh at redhat dot com 2012-02-27 6:17 ` [Bug nis/13761] " siddhesh at redhat dot com 2012-02-28 3:39 ` carlos at systemhalted dot org @ 2012-02-28 3:43 ` carlos at systemhalted dot org 2012-02-28 3:44 ` carlos at systemhalted dot org ` (5 subsequent siblings) 8 siblings, 0 replies; 10+ messages in thread From: carlos at systemhalted dot org @ 2012-02-28 3:43 UTC (permalink / raw) To: glibc-bugs http://sourceware.org/bugzilla/show_bug.cgi?id=13761 Carlos O'Donell <carlos at systemhalted dot org> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|examined?(carlos at | |systemhalted dot org) | -- Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 10+ messages in thread
* [Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group 2012-02-27 6:10 [Bug nis/13761] New: [PATCH] Fix allocation in nss_compat for large number of memberships to a group siddhesh at redhat dot com ` (2 preceding siblings ...) 2012-02-28 3:43 ` carlos at systemhalted dot org @ 2012-02-28 3:44 ` carlos at systemhalted dot org 2012-02-28 6:22 ` kukuk at suse dot de ` (4 subsequent siblings) 8 siblings, 0 replies; 10+ messages in thread From: carlos at systemhalted dot org @ 2012-02-28 3:44 UTC (permalink / raw) To: glibc-bugs http://sourceware.org/bugzilla/show_bug.cgi?id=13761 Carlos O'Donell <carlos at systemhalted dot org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |UNCONFIRMED AssignedTo|unassigned at sourceware |carlos at systemhalted dot |dot org |org Ever Confirmed|1 |0 --- Comment #2 from Carlos O'Donell <carlos at systemhalted dot org> 2012-02-28 03:42:14 UTC --- I'm reviewing this issue. -- Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 10+ messages in thread
* [Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group 2012-02-27 6:10 [Bug nis/13761] New: [PATCH] Fix allocation in nss_compat for large number of memberships to a group siddhesh at redhat dot com ` (3 preceding siblings ...) 2012-02-28 3:44 ` carlos at systemhalted dot org @ 2012-02-28 6:22 ` kukuk at suse dot de 2012-03-30 7:32 ` siddhesh at redhat dot com ` (3 subsequent siblings) 8 siblings, 0 replies; 10+ messages in thread From: kukuk at suse dot de @ 2012-02-28 6:22 UTC (permalink / raw) To: glibc-bugs http://sourceware.org/bugzilla/show_bug.cgi?id=13761 Thorsten Kukuk <kukuk at suse dot de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|kukuk at suse dot de | -- Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 10+ messages in thread
* [Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group 2012-02-27 6:10 [Bug nis/13761] New: [PATCH] Fix allocation in nss_compat for large number of memberships to a group siddhesh at redhat dot com ` (4 preceding siblings ...) 2012-02-28 6:22 ` kukuk at suse dot de @ 2012-03-30 7:32 ` siddhesh at redhat dot com 2012-04-12 15:43 ` law at redhat dot com ` (2 subsequent siblings) 8 siblings, 0 replies; 10+ messages in thread From: siddhesh at redhat dot com @ 2012-03-30 7:32 UTC (permalink / raw) To: glibc-bugs http://sourceware.org/bugzilla/show_bug.cgi?id=13761 Siddhesh Poyarekar <siddhesh at redhat dot com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED Resolution| |FIXED --- Comment #3 from Siddhesh Poyarekar <siddhesh at redhat dot com> 2012-03-30 07:28:41 UTC --- Fixed upstream with 984a42374ce2055836f580c2240306171757ea72. -- Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 10+ messages in thread
* [Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group 2012-02-27 6:10 [Bug nis/13761] New: [PATCH] Fix allocation in nss_compat for large number of memberships to a group siddhesh at redhat dot com ` (5 preceding siblings ...) 2012-03-30 7:32 ` siddhesh at redhat dot com @ 2012-04-12 15:43 ` law at redhat dot com 2012-04-12 15:45 ` law at redhat dot com 2012-11-29 17:48 ` law at redhat dot com 8 siblings, 0 replies; 10+ messages in thread From: law at redhat dot com @ 2012-04-12 15:43 UTC (permalink / raw) To: glibc-bugs http://sourceware.org/bugzilla/show_bug.cgi?id=13761 --- Comment #4 from law at redhat dot com 2012-04-12 15:43:35 UTC --- Created attachment 6339 --> http://sourceware.org/bugzilla/attachment.cgi?id=6339 Patch for another unbound allocate in nscd group handling Additional QE testing showed another unbounded alloca in the nscd group handling; specifically the allocation of DATASET within cache_addgr. Using the testing procedures in this BZ nscd would coredump after blowing out the stack. Attached is a follow up-patch we're using to address the additional unbound alloca. -- Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 10+ messages in thread
* [Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group 2012-02-27 6:10 [Bug nis/13761] New: [PATCH] Fix allocation in nss_compat for large number of memberships to a group siddhesh at redhat dot com ` (6 preceding siblings ...) 2012-04-12 15:43 ` law at redhat dot com @ 2012-04-12 15:45 ` law at redhat dot com 2012-11-29 17:48 ` law at redhat dot com 8 siblings, 0 replies; 10+ messages in thread From: law at redhat dot com @ 2012-04-12 15:45 UTC (permalink / raw) To: glibc-bugs http://sourceware.org/bugzilla/show_bug.cgi?id=13761 law at redhat dot com changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Last reconfirmed| |2012-04-12 CC| |law at redhat dot com Resolution|FIXED | Ever Confirmed|0 |1 --- Comment #5 from law at redhat dot com 2012-04-12 15:44:44 UTC --- nscd is still segfaulting due to unbound alloca uses using the testing procedures originally reported in this bug. -- Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 10+ messages in thread
* [Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group 2012-02-27 6:10 [Bug nis/13761] New: [PATCH] Fix allocation in nss_compat for large number of memberships to a group siddhesh at redhat dot com ` (7 preceding siblings ...) 2012-04-12 15:45 ` law at redhat dot com @ 2012-11-29 17:48 ` law at redhat dot com 8 siblings, 0 replies; 10+ messages in thread From: law at redhat dot com @ 2012-11-29 17:48 UTC (permalink / raw) To: glibc-bugs http://sourceware.org/bugzilla/show_bug.cgi?id=13761 law at redhat dot com changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |FIXED --- Comment #6 from law at redhat dot com 2012-11-29 17:48:07 UTC --- 2012-11-28 Jeff Law <law@redhat.com> [BZ #13761] * nscd/grpcache.c (cache_addgr): Rename alloca_used to dataset_temporary. Track alloca usage into alloca_used. If dataset is large allocate and release it via malloc/free. -- Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug. ^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2012-11-29 17:48 UTC | newest] Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2012-02-27 6:10 [Bug nis/13761] New: [PATCH] Fix allocation in nss_compat for large number of memberships to a group siddhesh at redhat dot com 2012-02-27 6:17 ` [Bug nis/13761] " siddhesh at redhat dot com 2012-02-28 3:39 ` carlos at systemhalted dot org 2012-02-28 3:43 ` carlos at systemhalted dot org 2012-02-28 3:44 ` carlos at systemhalted dot org 2012-02-28 6:22 ` kukuk at suse dot de 2012-03-30 7:32 ` siddhesh at redhat dot com 2012-04-12 15:43 ` law at redhat dot com 2012-04-12 15:45 ` law at redhat dot com 2012-11-29 17:48 ` law at redhat dot com
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).