[Bug network/14498] New: default /var/db/services.db triggers infinite CPU loop with getaddrinfo()

[Bug network/14498] New: default /var/db/services.db triggers infinite CPU loop with getaddrinfo()

[vapier at gentoo dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14498

             Bug #: 14498
           Summary: default /var/db/services.db triggers infinite CPU loop
                    with getaddrinfo()
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: network
        AssignedTo: unassigned@sourceware.org
        ReportedBy: vapier@gentoo.org
                CC: toolchain@gentoo.org
    Classification: Unclassified
              Host: x86_64-linux-gnu


using the default /var/db/Makefile provided by glibc:
cd /var/db
rm -f *.db
make

then running a simple getaddrinfo() request:
wget https://432020.bugs.gentoo.org/attachment.cgi?id=321736 -O test.c
gcc test.c
./a.out
<hang>

seems like we trigger an infinite cpu loop somewhere in the look up logic

(all details and example code provided by Maxim Kammerer)

reproduced with glibc-2.15 and 2.16

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/14498] default /var/db/services.db triggers infinite CPU loop with getaddrinfo()

[cloos at jhcloos dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14498

James Cloos <cloos at jhcloos dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |cloos at jhcloos dot com

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/14498] default /var/db/services.db triggers infinite CPU loop with getaddrinfo()

[schwab@linux-m68k.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14498

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |WAITING

--- Comment #1 from Andreas Schwab <schwab@linux-m68k.org> 2013-01-15 11:04:05 UTC ---
I cannot reproduce that with 2.17.  Does it still happen?

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/14498] default /var/db/services.db triggers infinite CPU loop with getaddrinfo()

[vapier at gentoo dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14498

--- Comment #2 from Mike Frysinger <vapier at gentoo dot org> 2013-01-15 17:50:41 UTC ---
it is still hanging for me w/2.17.  i am not running nscd.

the Gentoo patchset is small, but lemme double check it fails on vanilla 2.17.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/14498] default /var/db/services.db triggers infinite CPU loop with getaddrinfo()

[vapier at gentoo dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14498

--- Comment #3 from Mike Frysinger <vapier at gentoo dot org> 2013-01-15 18:36:00 UTC ---
just tried latest master (357679d2fc567e8d6c030cf0f0fd54f6c31e23a3) and it
still fails with the test case

maybe the input /etc/services matters ?  here's my /etc/services and
services.db.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/14498] default /var/db/services.db triggers infinite CPU loop with getaddrinfo()

[vapier at gentoo dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14498

--- Comment #4 from Mike Frysinger <vapier at gentoo dot org> 2013-01-15 18:36:53 UTC ---
Created attachment 6819
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6819
generated services.db

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/14498] default /var/db/services.db triggers infinite CPU loop with getaddrinfo()

[vapier at gentoo dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14498

--- Comment #5 from Mike Frysinger <vapier at gentoo dot org> 2013-01-15 18:37:53 UTC ---
Created attachment 6820
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6820
/etc/services

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/14498] default /var/db/services.db triggers infinite CPU loop with getaddrinfo()

[vapier at gentoo dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14498

--- Comment #6 from Mike Frysinger <vapier at gentoo dot org> 2013-01-15 18:41:54 UTC ---
hmm, if i chop my /etc/services at line ~250 (first line to delete: cisco-fna),
then i can build a services.db and the test case does not hang ...

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug network/14498] default /var/db/services.db triggers infinite CPU loop with getaddrinfo()

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=14498

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/14498] default /var/db/services.db triggers infinite CPU loop with getaddrinfo()

[aoliva at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=14498

Alexandre Oliva <aoliva at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |ASSIGNED
                 CC|                            |aoliva at sourceware dot org
           Assignee|unassigned at sourceware dot org   |aoliva at sourceware dot org

--- Comment #7 from Alexandre Oliva <aoliva at sourceware dot org> ---
Created attachment 7872
  --> https://sourceware.org/bugzilla/attachment.cgi?id=7872&action=edit
two patches in one, both fixing the problem

We use some code from nss_files in nss_db, and nss_files' code used “continue”
to skip a non-matching proto, but in nss_db this bypassed the code to advance
to the next entry.  Both changes individually fix the problem; I'm undecided as
to which one to go with, or maybe even go with both.  Thoughts?

-- 
You are receiving this mail because:
You are on the CC list for the bug.
>From glibc-bugs-return-26498-listarch-glibc-bugs=sources.redhat.com@sourceware.org Fri Oct 31 07:14:04 2014
Return-Path: <glibc-bugs-return-26498-listarch-glibc-bugs=sources.redhat.com@sourceware.org>
Delivered-To: listarch-glibc-bugs@sources.redhat.com
Received: (qmail 17902 invoked by alias); 31 Oct 2014 07:14:04 -0000
Mailing-List: contact glibc-bugs-help@sourceware.org; run by ezmlm
Precedence: bulk
List-Id: <glibc-bugs.sourceware.org>
List-Subscribe: <mailto:glibc-bugs-subscribe@sourceware.org>
List-Post: <mailto:glibc-bugs@sourceware.org>
List-Help: <mailto:glibc-bugs-help@sourceware.org>, <http://sourceware.org/lists.html#faqs>
Sender: glibc-bugs-owner@sourceware.org
Delivered-To: mailing list glibc-bugs@sourceware.org
Received: (qmail 17786 invoked by uid 48); 31 Oct 2014 07:13:58 -0000
From: "aoliva at sourceware dot org" <sourceware-bugzilla@sourceware.org>
To: glibc-bugs@sourceware.org
Subject: [Bug network/16001] calls to getaddrinfo() leak memory.
Date: Fri, 31 Oct 2014 07:14:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: glibc
X-Bugzilla-Component: network
X-Bugzilla-Version: 2.18
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: aoliva at sourceware dot org
X-Bugzilla-Status: RESOLVED
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at sourceware dot org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: security-
X-Bugzilla-Changed-Fields:
Message-ID: <bug-16001-131-iJeyf7aXcE@http.sourceware.org/bugzilla/>
In-Reply-To: <bug-16001-131@http.sourceware.org/bugzilla/>
References: <bug-16001-131@http.sourceware.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-10/txt/msg00134.txt.bz2
Content-length: 439

https://sourceware.org/bugzilla/show_bug.cgi?id\x16001

--- Comment #5 from Alexandre Oliva <aoliva at sourceware dot org> ---
If I were to do that, how would the testcase report the memory leak?  The bug
report doesn't say that, and I don't see anything in the testcase that covers
that either.

Could this possibly have been fixed by the patch for bug 16002?

--
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/14498] default /var/db/services.db triggers infinite CPU loop with getaddrinfo()

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=14498

--- Comment #8 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master has been updated
       via  b59d114bd1e0571fba85b3cbcc61d4f4b42f5d1b (commit)
       via  f3d945d5f2b9d7d44032c461af588c6d54f5664b (commit)
       via  4969890247d7d6a548f17641ed5a18f4b713d211 (commit)
      from  81959214868c9ac9e425fbf0fa3fd9135e207f7e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=b59d114bd1e0571fba85b3cbcc61d4f4b42f5d1b

commit b59d114bd1e0571fba85b3cbcc61d4f4b42f5d1b
Author: Alexandre Oliva <aoliva@redhat.com>
Date:   Sat Sep 27 07:23:39 2014 -0300

    BZ#16469: resolv: skip leading dot in domain to search

    This should only happen if the domain to search is the root,
    represented as "." rather than by an empty string.  Skipping it here
    prevents libc_res_nquerydomain from duplicating the trailing dot,
    which would cause the domain name compression to fail.

    for  ChangeLog

        [BZ #16469]
        * resolv/res_query.c (__libc_res_nsearch): Skip leading dot in
        search domain names.

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=f3d945d5f2b9d7d44032c461af588c6d54f5664b

commit f3d945d5f2b9d7d44032c461af588c6d54f5664b
Author: Alexandre Oliva <aoliva@redhat.com>
Date:   Sun Nov 9 13:51:09 2014 -0200

    BZ#16469: don't drop trailing dot in res_nquerydomain(..., name, NULL, ...)

    If we drop it here, we will fail to detect a duplicate trailing dot
    later on.  Retaining, OTOH, has no ill effects whatsoever, and it even
    saves us the trouble of copying the domain name minus the trailing
    dot, like we used to do.

    for ChangeLog

        [BZ #16469]
        * NEWS: Update.
        * resolv/res_query.c (__libc_res_nquerydomain): Retain
        trailing dot.
        * posix/tst-getaddrinfo5.c: New.
        * posix/Makefile (tests): Add it.

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4969890247d7d6a548f17641ed5a18f4b713d211

commit 4969890247d7d6a548f17641ed5a18f4b713d211
Author: Alexandre Oliva <aoliva@redhat.com>
Date:   Fri Nov 21 03:29:56 2014 -0200

    BZ#14498: fix infinite loop in nss_db_getservbyname

    nss_db uses nss_files code for services, but a continue on protocol
    mismatch that doesn't affect nss_files skipped the code that advanced
    to the next db entry.  Any one of these changes would suffice to fix
    it, but fixing both makes them both safer to reuse elsewhere.

    for  ChangeLog

        [BZ #14498]
        * NEWS: Fixed.
        * nss/nss_db/db-XXX.c (_nss_db_get##name##_r): Update hidx
        after parsing line but before break_if_match.
        * nss/nss_files/files-service (DB_LOOKUP): Don't "continue;"
        if there is a protocol mismatch.

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                     |   24 ++++++++++++++
 NEWS                          |    8 ++--
 nss/nss_db/db-XXX.c           |    9 +++--
 nss/nss_files/files-service.c |    7 +++-
 posix/Makefile                |    2 +-
 posix/tst-getaddrinfo5.c      |   69 +++++++++++++++++++++++++++++++++++++++++
 resolv/res_query.c            |   30 +++++++++--------
 7 files changed, 125 insertions(+), 24 deletions(-)
 create mode 100644 posix/tst-getaddrinfo5.c

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/14498] default /var/db/services.db triggers infinite CPU loop with getaddrinfo()

[aoliva at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=14498

Alexandre Oliva <aoliva at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Alexandre Oliva <aoliva at sourceware dot org> ---
Fixed

-- 
You are receiving this mail because:
You are on the CC list for the bug.