From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 97313 invoked by alias); 31 Oct 2019 23:16:38 -0000 Mailing-List: contact libc-stable-help@sourceware.org; run by ezmlm Precedence: bulk List-Post: List-Help: List-Subscribe: List-Archive: Sender: libc-stable-owner@sourceware.org Received: (qmail 97302 invoked by uid 89); 31 Oct 2019 23:16:37 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Checked: by ClamAV 0.100.3 on sourceware.org X-Virus-Found: No X-Spam-SWARE-Status: No, score=-18.0 required=5.0 tests=AWL,BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,KAM_SHORT,SPF_PASS autolearn=ham version=3.3.1 spammy=Service, scanned, libunwind, lgcc X-Spam-Status: No, score=-18.0 required=5.0 tests=AWL,BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,KAM_SHORT,SPF_PASS autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on sourceware.org X-Spam-Level: X-HELO: us-smtp-delivery-1.mimecast.com Received: from us-smtp-1.mimecast.com (HELO us-smtp-delivery-1.mimecast.com) (207.211.31.81) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Thu, 31 Oct 2019 23:16:34 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1572563793; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Eegig4JrYMMvykyQ7X9U/wwXln45BUWv4jw36HZgCWg=; b=HPGg0Vyw5lVnenNuuM9SsGRUwQNu7/s7nCFUT8nOERGw5NieXMGzH4Tq753ja1mZtv3Bj4 0Pm4XszNJt87Wac4mZUezEOB7Fl0icWEg/mSZbdO/3zDTRuvOqDNzP4MRBN87fccD4HwPm 9fvhUpkESNCS+Em39T2UYLjX4XSMJK8= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-215-9XcvBWFVPXO9FlaJqMBNJA-1; Thu, 31 Oct 2019 19:16:29 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 69F828017E0 for ; Thu, 31 Oct 2019 23:16:28 +0000 (UTC) Received: from greed.delorie.com (ovpn-116-99.phx2.redhat.com [10.3.116.99]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 3C2FA5D9CA for ; Thu, 31 Oct 2019 23:16:28 +0000 (UTC) Received: from greed.delorie.com.redhat.com (localhost [127.0.0.1]) by greed.delorie.com (8.14.7/8.14.7) with ESMTP id x9VNGRqN028406 for ; Thu, 31 Oct 2019 19:16:27 -0400 Date: Tue, 01 Jan 2019 00:00:00 -0000 Message-Id: From: DJ Delorie To: libc-stable@sourceware.org Subject: [2.29 COMMITTED] nss_db: fix endent wrt NULL mappings [BZ #24695] [BZ #24696] X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-MC-Unique: 9XcvBWFVPXO9FlaJqMBNJA-1 X-Mimecast-Spam-Score: 0 Content-Type: text/plain; charset=WINDOWS-1252 Content-Transfer-Encoding: quoted-printable X-IsSubscribed: yes X-SW-Source: 2019-10/txt/msg00016.txt.bz2 From: DJ Delorie nss_db allows for getpwent et al to be called without a set*ent, but it only works once. After the last get*ent a set*ent is required to restart, because the end*ent did not properly reset the module. Resetting it to NULL allows for a proper restart. If the database doesn't exist, however, end*ent erroniously called munmap which set errno. The test case runs "makedb" inside the testroot, so needs selinux DSOs installed. (cherry picked from commit 99135114ba23c3110b7e4e650fabdc5e639746b7) diff --git a/ChangeLog b/ChangeLog index 582ba45c79..440aa42cef 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,19 @@ +2019-07-10 DJ Delorie + Sergei Trofimovich + + [BZ #24696] + [BZ #24695] + * nss/nss_db/db-open.c (internal_endent): Protect against NULL + mappings. + * nss/tst-nss-db-endgrent.c: New. + * nss/tst-nss-db-endgrent.root: New. + * nss/tst-nss-db-endpwent.c: New. + * nss/tst-nss-db-endpwent.root: New. + * nss/Makefile: Add new tests. + * support/links-dso-program-c.c: Add selinux dependency. + * support/links-dso-program.cc: Add selinux dependency. + * support/Makefile: Build those with -lselinux if enabled. + 2019-05-14 Adhemerval Zanella =20 * support/Makefile (CFLAGS-support_paths.c): Add -DBINDIR_PATH. diff --git a/nss/Makefile b/nss/Makefile index 0fa28f0c5e..680f8734b9 100644 --- a/nss/Makefile +++ b/nss/Makefile @@ -60,7 +60,9 @@ tests =3D test-netdb test-digits-dots tst-nss-getpwent = bug17079 \ xtests =3D bug-erange =20 tests-container =3D \ - tst-nss-test3 + tst-nss-test3 \ + tst-nss-db-endpwent \ + tst-nss-db-endgrent =20 # Tests which need libdl ifeq (yes,$(build-shared)) diff --git a/nss/nss_db/db-open.c b/nss/nss_db/db-open.c index 8a83d6b930..3fa11e9ab0 100644 --- a/nss/nss_db/db-open.c +++ b/nss/nss_db/db-open.c @@ -63,5 +63,9 @@ internal_setent (const char *file, struct nss_db_map *map= ping) void internal_endent (struct nss_db_map *mapping) { - munmap (mapping->header, mapping->len); + if (mapping->header !=3D NULL) + { + munmap (mapping->header, mapping->len); + mapping->header =3D NULL; + } } diff --git a/nss/tst-nss-db-endgrent.c b/nss/tst-nss-db-endgrent.c new file mode 100644 index 0000000000..367cc6c901 --- /dev/null +++ b/nss/tst-nss-db-endgrent.c @@ -0,0 +1,54 @@ +/* Test for endgrent changing errno for BZ #24696 + Copyright (C) 2019 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include +#include + +#include +#include + +/* The following test verifies that if the db NSS Service is initialized + with no database (getgrent), that a subsequent closure (endgrent) does + not set errno. In the case of the db service it is not an error to close + the service and so it should not set errno. */ + +static int +do_test (void) +{ + /* Just make sure it's not there, although usually it won't be. */ + unlink ("/var/db/group.db"); + + /* This, in conjunction with the testroot's nsswitch.conf, causes + the nss_db module to be "connected" and initialized - but the + testroot has no group.db, so no mapping will be created. */ + getgrent (); + + errno =3D 0; + + /* Before the fix, this would call munmap (NULL) and set errno. */ + endgrent (); + + if (errno !=3D 0) + FAIL_EXIT1 ("endgrent set errno to %d\n", errno); + + return 0; +} +#include diff --git a/nss/tst-nss-db-endgrent.root/etc/nsswitch.conf b/nss/tst-nss-d= b-endgrent.root/etc/nsswitch.conf new file mode 100644 index 0000000000..21471df94f --- /dev/null +++ b/nss/tst-nss-db-endgrent.root/etc/nsswitch.conf @@ -0,0 +1 @@ +group : db files diff --git a/nss/tst-nss-db-endpwent.c b/nss/tst-nss-db-endpwent.c new file mode 100644 index 0000000000..cb85410b7c --- /dev/null +++ b/nss/tst-nss-db-endpwent.c @@ -0,0 +1,66 @@ +/* Test for endpwent->getpwent crash for BZ #24695 + Copyright (C) 2019 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include + +#include +#include + +/* It is entirely allowed to start with a getpwent call without + resetting the state of the service via a call to setpwent. + You can also call getpwent more times than you have entries in + the service, and it should not fail. This test iteratates the + database once, gets to the end, and then attempts a second + iteration to look for crashes. */ + +static void +try_it (void) +{ + struct passwd *pw; + + /* setpwent is intentionally omitted here. The first call to + getpwent detects that it's first and initializes. The second + time try_it is called, this "first call" was not detected before + the fix, and getpwent would crash. */ + + while ((pw =3D getpwent ()) !=3D NULL) + ; + + /* We only care if this segfaults or not. */ + endpwent (); +} + +static int +do_test (void) +{ + char *cmd; + + cmd =3D xasprintf ("%s/makedb -o /var/db/passwd.db /var/db/passwd.in", + support_bindir_prefix); + system (cmd); + free (cmd); + + try_it (); + try_it (); + + return 0; +} +#include diff --git a/nss/tst-nss-db-endpwent.root/etc/nsswitch.conf b/nss/tst-nss-d= b-endpwent.root/etc/nsswitch.conf new file mode 100644 index 0000000000..593ffc564a --- /dev/null +++ b/nss/tst-nss-db-endpwent.root/etc/nsswitch.conf @@ -0,0 +1 @@ +passwd: db diff --git a/nss/tst-nss-db-endpwent.root/var/db/passwd.in b/nss/tst-nss-db= -endpwent.root/var/db/passwd.in new file mode 100644 index 0000000000..98f39126ef --- /dev/null +++ b/nss/tst-nss-db-endpwent.root/var/db/passwd.in @@ -0,0 +1,4 @@ +.root root:x:0:0:root:/root:/bin/bash +=3D0 root:x:0:0:root:/root:/bin/bash +.bin bin:x:1:1:bin:/bin:/sbin/nologin +=3D1 bin:x:1:1:bin:/bin:/sbin/nologin diff --git a/support/Makefile b/support/Makefile index 5542de3fa1..e0c25ecb79 100644 --- a/support/Makefile +++ b/support/Makefile @@ -182,6 +182,11 @@ LINKS_DSO_PROGRAM =3D links-dso-program LDLIBS-links-dso-program =3D -lstdc++ -lgcc -lgcc_s $(libunwind) endif =20 +ifeq (yes,$(have-selinux)) +LDLIBS-$(LINKS_DSO_PROGRAM) +=3D -lselinux +endif + + LDLIBS-test-container =3D $(libsupport) =20 others +=3D test-container diff --git a/support/links-dso-program-c.c b/support/links-dso-program-c.c index d28a28a0d0..5fcbab2c17 100644 --- a/support/links-dso-program-c.c +++ b/support/links-dso-program-c.c @@ -1,9 +1,26 @@ #include =20 +/* makedb needs selinux dso's. */ +#ifdef HAVE_SELINUX +# include +#endif + +/* The purpose of this file is to indicate to the build system which + shared objects need to be copied into the testroot, such as gcc or + selinux support libraries. This program is never executed, only + scanned for dependencies on shared objects, so the code below may + seem weird - it's written to survive gcc optimization and force + such dependencies. +*/ + int main (int argc, char **argv) { /* Complexity to keep gcc from optimizing this away. */ printf ("This is a test %s.\n", argc > 1 ? argv[1] : "null"); +#ifdef HAVE_SELINUX + /* This exists to force libselinux.so to be required. */ + printf ("selinux %d\n", is_selinux_enabled ()); +#endif return 0; } diff --git a/support/links-dso-program.cc b/support/links-dso-program.cc index dba6976c06..4bc2411086 100644 --- a/support/links-dso-program.cc +++ b/support/links-dso-program.cc @@ -1,11 +1,28 @@ #include =20 +/* makedb needs selinux dso's. */ +#ifdef HAVE_SELINUX +# include +#endif + using namespace std; =20 +/* The purpose of this file is to indicate to the build system which + shared objects need to be copied into the testroot, such as gcc or + selinux support libraries. This program is never executed, only + scanned for dependencies on shared objects, so the code below may + seem weird - it's written to survive gcc optimization and force + such dependencies. +*/ + int main (int argc, char **argv) { /* Complexity to keep gcc from optimizing this away. */ cout << (argc > 1 ? argv[1] : "null"); +#ifdef HAVE_SELINUX + /* This exists to force libselinux.so to be required. */ + cout << "selinux " << is_selinux_enabled (); +#endif return 0; }