Race observed in if_nametoindex function (not MT-Safe)

Race observed in if_nametoindex function (not MT-Safe)

[pgowda cve]

Hi,

The race and assert-triggering was observed in if_nametoindex function.
It calls __opensock, which contains two static variables (last_type,
last_family)
that can race, triggering an assert on line 63 of opensock.c.
The variables are set in the reverse order to which they are checked.
Since there is no synchronization between these variables, should the function
not be made MT-Safe.

The patch was originally posted at:-
https://sourceware.org/pipermail/libc-alpha/2014-January/048052.html
It mentions the function as MT-Safe but race was observed.

We may need a memory barrier (atomic_[read|write]_barrier() ? ) to
ensure that the
compiler doesn't re-order assembly instructions and has last_family be
set before last_type.

Environment
Observed during a system restart when the processes start up and
software calls if_nametoindex from multiple threads.
GLIBC was dynamically Linked.

Regards,
pgowda

Re: Race observed in if_nametoindex function (not MT-Safe)

[Adhemerval Zanella]

On Mon, Sep 13, 2021 at 11:15 AM pgowda cve via Libc-help
<libc-help@sourceware.org> wrote:
>
> Hi,
>
> The race and assert-triggering was observed in if_nametoindex function.
> It calls __opensock, which contains two static variables (last_type,
> last_family)
> that can race, triggering an assert on line 63 of opensock.c.
> The variables are set in the reverse order to which they are checked.
> Since there is no synchronization between these variables, should the function
> not be made MT-Safe.
>
> The patch was originally posted at:-
> https://sourceware.org/pipermail/libc-alpha/2014-January/048052.html
> It mentions the function as MT-Safe but race was observed.
>
> We may need a memory barrier (atomic_[read|write]_barrier() ? ) to
> ensure that the
> compiler doesn't re-order assembly instructions and has last_family be
> set before last_type.
>
> Environment
> Observed during a system restart when the processes start up and
> software calls if_nametoindex from multiple threads.
> GLIBC was dynamically Linked.
>
> Regards,
> pgowda

I agree, I haved opened
https://sourceware.org/bugzilla/show_bug.cgi?id=28353 to track it.
Thanks for reporting it.