[Bug string/30112] New: [bisected] glibc 2.37 fails to print IPv6 adresses

[Bug string/30112] New: [bisected] glibc 2.37 fails to print IPv6 adresses

[freswa at archlinux dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=30112

            Bug ID: 30112
           Summary: [bisected] glibc 2.37 fails to print IPv6 adresses
           Product: glibc
           Version: 2.37
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: string
          Assignee: unassigned at sourceware dot org
          Reporter: freswa at archlinux dot org
  Target Milestone: ---

We've received a downstream bug report from systemd, that IPv6 output is
truncated since glibc 2.37. The issue has been bisected to commit
642933158e7cf072d873231b1a9bb03291f2b989 (first bad). To reproduce:

ip route add dev eth0 fd8d:4d6d:3ccb:500:c79:2339:edce:ece1 proto static
ip -6 route

bad output:
fd8d:4d6d:3ccb:500:c79:2339:edc dev eth0 proto static metric 1024 pref medium

good output:
fd8d:4d6d:3ccb:500:c79:2339:edce:ece1  dev eth0 proto static metric 1024 pref
medium

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug string/30112] [bisected] glibc 2.37 fails to print IPv6 adresses

[freswa at archlinux dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=30112

freswa <freswa at archlinux dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |freswa at archlinux dot org

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug string/30112] [bisected] glibc 2.37 fails to print IPv6 adresses

[vmlinuz386 at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30112

Gerardo Exequiel Pozzi <vmlinuz386 at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |vmlinuz386 at gmail dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug string/30112] [bisected] glibc 2.37 fails to print IPv6 adresses

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=30112

Sam James <sam at gentoo dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sam at gentoo dot org

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug string/30112] [bisected] glibc 2.37 fails to print IPv6 adresses since 642933158e7cf072d873231b1a9bb03291f2b989

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=30112

Sam James <sam at gentoo dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |goldstein.w.n at gmail dot com
            Summary|[bisected] glibc 2.37 fails |[bisected] glibc 2.37 fails
                   |to print IPv6 adresses      |to print IPv6 adresses
                   |                            |since
                   |                            |642933158e7cf072d873231b1a9
                   |                            |bb03291f2b989

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug string/30112] [bisected] glibc 2.37 fails to print IPv6 adresses since 642933158e7cf072d873231b1a9bb03291f2b989

[dilfridge at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=30112

Andreas K. Huettel <dilfridge at gentoo dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dilfridge at gentoo dot org,
                   |                            |toolchain at gentoo dot org

--- Comment #1 from Andreas K. Huettel <dilfridge at gentoo dot org> ---
I can confirm this regression in 2.37

noumea ~ # ip -6 route
::1 dev lo proto kernel metric 256 pref medium
noumea ~ # 
noumea ~ # 
noumea ~ # ip route add dev lo fd8d:4d6d:3ccb:500:c79:2339:edce:ece1 proto
static
noumea ~ # 
noumea ~ # 
noumea ~ # ip -6 route
::1 dev lo proto kernel metric 256 pref medium
fd8d:4d6d:3ccb:500:c79:2339:edce:ece1 dev lo proto static metric 1024 pref
medium
noumea ~ # /lib64/libc.so.6 | head -1
GNU C Library (Gentoo 2.36-r5 p5) stable release version 2.36.
noumea ~ # 
noumea ~ # 
noumea ~ # systemd-nspawn -M amd64 --bind /var/db/repos/gentoo
Spawning container amd64 on /var/lib/machines/amd64.
Press ^] three times within 1s to kill container.
amd64 ~ # 
amd64 ~ # 
amd64 ~ # ip -6 route
::1 dev lo proto kernel metric 256 pref medium
fd8d:4d6d:3ccb:500:c79:2339:edc dev lo proto static metric 1024 pref medium
amd64 ~ # /lib64/libc.so.6 | head -1
GNU C Library (Gentoo 2.37 p2) stable release version 2.37.
amd64 ~ # 
amd64 ~ # 
logout
Container amd64 exited successfully.
noumea ~ # 
noumea ~ # 
noumea ~ # uname -a
Linux noumea 5.15.85-gentoo #2 SMP PREEMPT Mon Dec 26 23:22:44 CET 2022 x86_64
Intel(R) Core(TM) i7-8665U CPU @ 1.90GHz GenuineIntel GNU/Linux

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug string/30112] [bisected] glibc 2.37 fails to print IPv6 adresses since 642933158e7cf072d873231b1a9bb03291f2b989

[flo at geekplace dot eu]

https://sourceware.org/bugzilla/show_bug.cgi?id=30112

Florian Schmaus <flo at geekplace dot eu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |flo at geekplace dot eu

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug string/30112] [bisected] glibc 2.37 fails to print IPv6 adresses since 642933158e7cf072d873231b1a9bb03291f2b989

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=30112

--- Comment #2 from Sam James <sam at gentoo dot org> ---
I think this might be UB in iproute2 instead.

This output is from glibc-2.36, but I got the same w/ glibc-2.37:
```
$ valgrind ip -6 route
==122592== Memcheck, a memory error detector
==122592== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==122592== Using Valgrind-3.20.0 and LibVEX; rerun with -h for copyright info
==122592== Command: ip -6 route
==122592==
==122592== Source and destination overlap in strncpy(0x1ffefff283,
0x1ffefff283, 63)
==122592==    at 0x48493DA: strncpy (vg_replace_strmem.c:604)
==122592==    by 0x1200EC: strncpy (string_fortified.h:95)
==122592==    by 0x1200EC: print_route (iproute.c:819)
==122592==    by 0x17C3C5: rtnl_dump_filter_l (libnetlink.c:925)
==122592==    by 0x17D8FF: rtnl_dump_filter_errhndlr_nc (libnetlink.c:987)
==122592==    by 0x11E3D3: iproute_list_flush_or_save (iproute.c:1981)
==122592==    by 0x113C54: do_cmd (ip.c:137)
==122592==    by 0x1136F8: main (ip.c:327)
==122592==
::1 dev lo proto kernel metric 256 pref medium
[my network bits here]
==122592==
==122592== HEAP SUMMARY:
==122592==     in use at exit: 206 bytes in 3 blocks
==122592==   total heap usage: 10 allocs, 7 frees, 165,174 bytes allocated
==122592==
==122592== LEAK SUMMARY:
==122592==    definitely lost: 0 bytes in 0 blocks
==122592==    indirectly lost: 0 bytes in 0 blocks
==122592==      possibly lost: 0 bytes in 0 blocks
==122592==    still reachable: 206 bytes in 3 blocks
==122592==         suppressed: 0 bytes in 0 blocks
==122592== Rerun with --leak-check=full to see details of leaked memory
==122592==
==122592== For lists of detected and suppressed errors, rerun with: -s
==122592== ERROR SUMMARY: 3 errors from 1 contexts (suppressed: 0 from 0)
```

And from ASAN:
```
=================================================================
==108934==ERROR: AddressSanitizer: strncpy-param-overlap: memory ranges
[0x7f3651200380,0x7f3651200384) and [0x7f3651200380, 0x7f3651200384) overlap
    #0 0x7f36533fe03c in __interceptor_strncpy
/usr/src/debug/sys-devel/gcc-13.0.1_pre20230212/gcc-13-20230212/libsanitizer/asan/asan_interceptors.cpp:483
    #1 0x5616e76ac5b2 in strncpy /usr/include/bits/string_fortified.h:95
    #2 0x5616e76ac5b2 in print_route
/usr/src/debug/sys-apps/iproute2-6.1.0/iproute2-6.1.0/ip/iproute.c:819
    #3 0x5616e7784705 in rtnl_dump_filter_l
/usr/src/debug/sys-apps/iproute2-6.1.0/iproute2-6.1.0/lib/libnetlink.c:925
    #4 0x5616e778a598 in rtnl_dump_filter_errhndlr_nc
/usr/src/debug/sys-apps/iproute2-6.1.0/iproute2-6.1.0/lib/libnetlink.c:987
    #5 0x5616e76a8e89 in iproute_list_flush_or_save
/usr/src/debug/sys-apps/iproute2-6.1.0/iproute2-6.1.0/ip/iproute.c:1981
    #6 0x5616e76afcca in do_iproute
/usr/src/debug/sys-apps/iproute2-6.1.0/iproute2-6.1.0/ip/iproute.c:2358
    #7 0x5616e768f3bf in do_cmd
/usr/src/debug/sys-apps/iproute2-6.1.0/iproute2-6.1.0/ip/ip.c:137
    #8 0x5616e768d992 in main
/usr/src/debug/sys-apps/iproute2-6.1.0/iproute2-6.1.0/ip/ip.c:327
    #9 0x7f365318274f  (/usr/lib64/libc.so.6+0x2374f)
    #10 0x7f3653182808 in __libc_start_main (/usr/lib64/libc.so.6+0x23808)
    #11 0x5616e768f244 in _start (/usr/bin/ip+0x11244)

Address 0x7f3651200380 is located in stack of thread T0 at offset 896 in frame
    #0 0x5616e76aa38f in print_route
/usr/src/debug/sys-apps/iproute2-6.1.0/iproute2-6.1.0/ip/iproute.c:746

  This frame has 4 object(s):
    [48, 192) 'mxrta' (line 599)
    [256, 504) 'tb' (line 750)
    [576, 824) 'tb' (line 680)
    [896, 960) 'b1' (line 755) <== Memory access at offset 896 is inside this
variable
HINT: this may be a false positive if your program uses some custom stack
unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
Address 0x7f3651200380 is located in stack of thread T0 at offset 896 in frame
    #0 0x5616e76aa38f in print_route
/usr/src/debug/sys-apps/iproute2-6.1.0/iproute2-6.1.0/ip/iproute.c:746

  This frame has 4 object(s):
    [48, 192) 'mxrta' (line 599)
    [256, 504) 'tb' (line 750)
    [576, 824) 'tb' (line 680)
    [896, 960) 'b1' (line 755) <== Memory access at offset 896 is inside this
variable
HINT: this may be a false positive if your program uses some custom stack
unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: strncpy-param-overlap
/usr/src/debug/sys-devel/gcc-13.0.1_pre20230212/gcc-13-20230212/libsanitizer/asan/asan_interceptors.cpp:483
in __interceptor_strncpy
==108934==ABORTING
```

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug string/30112] [bisected] glibc 2.37 fails to print IPv6 adresses since 642933158e7cf072d873231b1a9bb03291f2b989

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=30112

--- Comment #3 from Sam James <sam at gentoo dot org> ---
(In reply to Sam James from comment #2)
> I think this might be UB in iproute2 instead.
> [...]

Reported at
https://lore.kernel.org/netdev/0011AC38-4823-4D0A-8580-B108D08959C2@gentoo.org/T/#u.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug string/30112] [bisected] glibc 2.37 fails to print IPv6 adresses since 642933158e7cf072d873231b1a9bb03291f2b989

[freswa at archlinux dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=30112

freswa <freswa at archlinux dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |NOTABUG

--- Comment #4 from freswa <freswa at archlinux dot org> ---
Can confirm this is resolved with applying the patch from Sam for iproute2.
Thanks a lot!

-- 
You are receiving this mail because:
You are on the CC list for the bug.