[Bug nis/13761] New: [PATCH] Fix allocation in nss_compat for large number of memberships to a group

[Bug nis/13761] New: [PATCH] Fix allocation in nss_compat for large number of memberships to a group

[siddhesh at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13761

             Bug #: 13761
           Summary: [PATCH] Fix allocation in nss_compat for large number
                    of memberships to a group
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nis
        AssignedTo: unassigned@sourceware.org
        ReportedBy: siddhesh@redhat.com
                CC: kukuk@suse.de
    Classification: Unclassified


nss_compat allocates buffer space on stack using alloca (and
extend_alloca) for initgroup and keeps extending it to fit in larger
lines. This breaks for cases where the number of members in a gorup
are very large, causing the alloca reference to go beyond thread stack
boundary. I have posted a patch on libc-alpha that implements a fallback to
malloc/free if the buffer size needed is beyond __libc_alloca_cutoff:

http://sourceware.org/ml/libc-alpha/2012-02/msg00503.html

How reproducible:
Always

Steps to Reproduce:
1. In /etc/nsswitch.conf:

group: compat
group_compat: files

2. Create a large number of users for a single group

for i in $(seq 1 70000); do
 useradd -M -N -s /sbin/nologin -G foo somelongusernameaaaaaaaaaaaa$i
 echo Created somelongusername$i
done

3. Start nscd
4. groups somelongusernameaaaaaaaaaaaa100

Actual results:
nscd crashes

Expected results:
nscd does not crash

Additional info:

This is also possible with ldap (the original case is with ldap):

group: files compat
group_compat: ldap

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group

[siddhesh at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13761

--- Comment #1 from Siddhesh Poyarekar <siddhesh at redhat dot com> 2012-02-27 06:16:45 UTC ---
Updated patch here:

http://sourceware.org/ml/libc-alpha/2012-02/msg00664.html

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group

[carlos at systemhalted dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=13761

Carlos O'Donell <carlos at systemhalted dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |carlos at systemhalted dot
                   |                            |org
              Flags|                            |examined?(carlos at
                   |                            |systemhalted dot org)

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group

[carlos at systemhalted dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=13761

Carlos O'Donell <carlos at systemhalted dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|examined?(carlos at         |
                   |systemhalted dot org)       |

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group

[carlos at systemhalted dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=13761

Carlos O'Donell <carlos at systemhalted dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |UNCONFIRMED
         AssignedTo|unassigned at sourceware    |carlos at systemhalted dot
                   |dot org                     |org
     Ever Confirmed|1                           |0

--- Comment #2 from Carlos O'Donell <carlos at systemhalted dot org> 2012-02-28 03:42:14 UTC ---
I'm reviewing this issue.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group

[kukuk at suse dot de]

http://sourceware.org/bugzilla/show_bug.cgi?id=13761

Thorsten Kukuk <kukuk at suse dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|kukuk at suse dot de        |

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group

[siddhesh at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13761

Siddhesh Poyarekar <siddhesh at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |FIXED

--- Comment #3 from Siddhesh Poyarekar <siddhesh at redhat dot com> 2012-03-30 07:28:41 UTC ---
Fixed upstream with 984a42374ce2055836f580c2240306171757ea72.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group

[law at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13761

--- Comment #4 from law at redhat dot com 2012-04-12 15:43:35 UTC ---
Created attachment 6339
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6339
Patch for another unbound allocate in nscd group handling

Additional QE testing showed another unbounded alloca in the nscd group
handling; specifically the allocation of DATASET within cache_addgr.  Using the
testing procedures in this BZ nscd would coredump after blowing out the stack.

Attached is a follow up-patch we're using to address the additional unbound
alloca.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group

[law at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13761

law at redhat dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
   Last reconfirmed|                            |2012-04-12
                 CC|                            |law at redhat dot com
         Resolution|FIXED                       |
     Ever Confirmed|0                           |1

--- Comment #5 from law at redhat dot com 2012-04-12 15:44:44 UTC ---
nscd is still segfaulting due to unbound alloca uses using the testing
procedures originally reported in this bug.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug nis/13761] [PATCH] Fix allocation in nss_compat for large number of memberships to a group

[law at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13761

law at redhat dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #6 from law at redhat dot com 2012-11-29 17:48:07 UTC ---
2012-11-28  Jeff Law  <law@redhat.com>

        [BZ #13761]
        * nscd/grpcache.c (cache_addgr): Rename alloca_used to
        dataset_temporary.  Track alloca usage into alloca_used.
        If dataset is large allocate and release it via malloc/free.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.