[Bug libc/16179] New: pointer mangling makes setnetgrent's setup racy

[Bug libc/16179] New: pointer mangling makes setnetgrent's setup racy

[aoliva at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=16179

            Bug ID: 16179
           Summary: pointer mangling makes setnetgrent's setup racy
           Product: glibc
           Version: 2.18
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: aoliva at sourceware dot org
                CC: drepper.fsp at gmail dot com

inet/getnetgrent_r.c:setup says:

<quote>

  static bool startp_initialized;
  static service_user *startp;
  int no_more;

  if (!startp_initialized)
    {
      /* Executing this more than once at the same time must yield the
         same result every time.  So we need no locking.  */
      no_more = __nss_netgroup_lookup (nipp, "setnetgrent", fctp);
      startp = no_more ? (service_user *) -1 : *nipp;
#ifdef PTR_MANGLE
      PTR_MANGLE (startp);
#endif

</quote>

If PTR_MANGLE is defined so as to modify startp, we will write to startp twice,
once without mangling, once with mangling, which breaks the assumption that we
need no locking: we'll have two results, one mangled, and another not mangled,
that might unexpectedly be used by a thread that won the initialization race,
if it happens to use the intermediate value written by the loser before it
computes and stores the final mangled value.

We should use an automatic variable to hold the intermediate value, mangle it
there, and only then store it in static storage.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/16179] pointer mangling makes setnetgrent's setup racy

[neleai at seznam dot cz]

https://sourceware.org/bugzilla/show_bug.cgi?id=16179

Ondrej Bilka <neleai at seznam dot cz> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |neleai at seznam dot cz

--- Comment #1 from Ondrej Bilka <neleai at seznam dot cz> ---
Do you have patch for that?

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/16179] pointer mangling makes setnetgrent's setup racy

[aoliva at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=16179

--- Comment #2 from Alexandre Oliva <aoliva at sourceware dot org> ---
No, I didn't write a patch, I only reported the bug to avoid forgetting about a
problem noticed while in the middle of another project.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug network/16179] pointer mangling makes setnetgrent's setup racy

[jsm28 at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=16179

Joseph Myers <jsm28 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|libc                        |network

-- 
You are receiving this mail because:
You are on the CC list for the bug.