[Bug nss/28752] New: Segfault in getpwuid when stat fails

["sam at gentoo dot org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=28752

            Bug ID: 28752
           Summary: Segfault in getpwuid when stat fails
           Product: glibc
           Version: 2.34
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nss
          Assignee: unassigned at sourceware dot org
          Reporter: sam at gentoo dot org
  Target Milestone: ---

Created attachment 13894
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13894&action=edit
reproducer-seccomp.c

Originally reported in Gentoo: https://bugs.gentoo.org/828070
Discussed on libc-help here:
https://sourceware.org/pipermail/libc-help/2021-December/006061.html

glib compiled with FAM support ends up crashing Firefox. Andreas Fink did some
substantial debugging and ended up finding that the issue is that stat (in
nss_database_check_reload_and_get) may fail when e.g. newfstatat is forbidden
by a seccomp filter.

I've attached Andreas' reproducer here. Needs to be linked against libseccomp.

azanella had a simple patch which works for me:
```
diff --git a/nss/nss_database.c b/nss/nss_database.c
index d56c5b798d..24e34213cd 100644
--- a/nss/nss_database.c
+++ b/nss/nss_database.c
@@ -424,10 +424,11 @@ nss_database_check_reload_and_get (struct
nss_database_state *local,
      errors here are very unlikely, but the chance that we're entering
      a container is also very unlikely, so we err on the side of both
      very unlikely things not happening at the same time.  */
-  if (__stat64_time64 ("/", &str) != 0
-      || (local->root_ino != 0
-         && (str.st_ino != local->root_ino
-             ||  str.st_dev != local->root_dev)))
+  if (__stat64_time64 ("/", &str) != 0)
+    return false;
+
+  if (local->root_ino != 0 && (str.st_ino != local->root_ino
+                              || str.st_dev != local->root_dev))
     {
       /* Change detected; disable reloading and return current state.  */
       atomic_store_release (&local->data.reload_disabled, 1);
```

-- 
You are receiving this mail because:
You are on the CC list for the bug.