public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug nss/28752] New: Segfault in getpwuid when stat fails
@ 2022-01-06 18:30 sam at gentoo dot org
  2022-01-07  9:56 ` [Bug nss/28752] " fweimer at redhat dot com
                   ` (6 more replies)
  0 siblings, 7 replies; 8+ messages in thread
From: sam at gentoo dot org @ 2022-01-06 18:30 UTC (permalink / raw)
  To: glibc-bugs

https://sourceware.org/bugzilla/show_bug.cgi?id=28752

            Bug ID: 28752
           Summary: Segfault in getpwuid when stat fails
           Product: glibc
           Version: 2.34
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nss
          Assignee: unassigned at sourceware dot org
          Reporter: sam at gentoo dot org
  Target Milestone: ---

Created attachment 13894
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13894&action=edit
reproducer-seccomp.c

Originally reported in Gentoo: https://bugs.gentoo.org/828070
Discussed on libc-help here:
https://sourceware.org/pipermail/libc-help/2021-December/006061.html

glib compiled with FAM support ends up crashing Firefox. Andreas Fink did some
substantial debugging and ended up finding that the issue is that stat (in
nss_database_check_reload_and_get) may fail when e.g. newfstatat is forbidden
by a seccomp filter.

I've attached Andreas' reproducer here. Needs to be linked against libseccomp.

azanella had a simple patch which works for me:
```
diff --git a/nss/nss_database.c b/nss/nss_database.c
index d56c5b798d..24e34213cd 100644
--- a/nss/nss_database.c
+++ b/nss/nss_database.c
@@ -424,10 +424,11 @@ nss_database_check_reload_and_get (struct
nss_database_state *local,
      errors here are very unlikely, but the chance that we're entering
      a container is also very unlikely, so we err on the side of both
      very unlikely things not happening at the same time.  */
-  if (__stat64_time64 ("/", &str) != 0
-      || (local->root_ino != 0
-         && (str.st_ino != local->root_ino
-             ||  str.st_dev != local->root_dev)))
+  if (__stat64_time64 ("/", &str) != 0)
+    return false;
+
+  if (local->root_ino != 0 && (str.st_ino != local->root_ino
+                              || str.st_dev != local->root_dev))
     {
       /* Change detected; disable reloading and return current state.  */
       atomic_store_release (&local->data.reload_disabled, 1);
```

-- 
You are receiving this mail because:
You are on the CC list for the bug.

^ permalink raw reply	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2022-06-19  2:19 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-06 18:30 [Bug nss/28752] New: Segfault in getpwuid when stat fails sam at gentoo dot org
2022-01-07  9:56 ` [Bug nss/28752] " fweimer at redhat dot com
2022-03-14 17:04 ` sam at gentoo dot org
2022-05-19 12:34 ` fweimer at redhat dot com
2022-06-09  5:34 ` sam at gentoo dot org
2022-06-09  5:35 ` sam at gentoo dot org
2022-06-19  2:18 ` sam at gentoo dot org
2022-06-19  2:19 ` sam at gentoo dot org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).