Bug 1471985

Summary: glibc: Incorrect pointer alignment in NSS group merge result construction
Product: [Fedora] Fedora Reporter: Florian Weimer <fweimer>
Component: glibcAssignee: Florian Weimer <fweimer>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 27CC: arjun.is, codonell, dj, fweimer, law, mfabian, pfrankli, siddhesh
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: glibc-2.25.90-26.fc27 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1463692 Environment:
Last Closed: 2018-01-12 10:25:37 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1463692    

Description Florian Weimer 2017-07-17 21:03:05 UTC
+++ This bug was initially created as a clone of Bug #1463692 +++

Sergey Kolosov discovered that the NSS group merge feature (added in bug 1298975) does not work on ppc64 and s390x.  The cause seems to be this code in grp/grp-merge.c:

  /* Copy the pointers from the members array into the buffer and assign them
     to the gr_mem member of destgrp.  */
  destgrp->gr_mem = (char **) &destbuf[c];
  len = sizeof (char *) * (memcount + 1);
  BUFCHECK (len);
  memcpy (&destbuf[c], members, len);
  c += len;
  free (members);
  members = NULL;

After the assigned to destgrp->gr_mem, we have:

(gdb) print destbuf
$1 = 0x10031000 "groupa"
(gdb) print c
$2 = 21
(gdb) print destgrp->gr_mem
$3 = (char **) 0x10031015

This pointer is not suitable aligned, and this triggers undefined behavior.

We should switch this code over to the allocation buffer interface, which deals with exactly this kind of problem.

--- Additional comment from Carlos O'Donell on 2017-06-21 16:47:50 CEST ---

Correct, gr_mem is not sufficiently aligned at the start.

On pcc64 any * must be doubleword aligned (8 bytes).
On s390 any * must be word aligned (4 bytes).

These are just natural alignment rules.

Comment 1 Florian Weimer 2017-07-17 21:03:33 UTC
This needs to be backported to Fedora 25 and Fedora 26.

Comment 2 Carlos O'Donell 2017-07-20 08:57:34 UTC
This is fixed on upstream master now.

commit f8cef4d07d9641e27629bd3ce2d13f5d702fb251
Author: DJ Delorie <dj>
Date:   Wed Jul 19 13:14:34 2017 -0400

    Fix cast-after-dereference
    
    Original code was dereferencing a char*, then casting the value
    to size_t.  Should cast the pointer to size_t* then deference.

commit 4fa8ae49aa169fb8d97882938e8bee3ed9ce5410
Author: DJ Delorie <dj>
Date:   Fri Jul 14 21:46:42 2017 -0400

    Fix BZ #21654 - grp-merge.c alignment
    
    * grp/grp_merge.c (__copy_grp): Align char** to minimum pointer
    alignment not char alignment.
    (__merge_grp): Likewise.

Comment 3 Jan Kurik 2017-08-15 07:21:11 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 27 development cycle.
Changing version to '27'.

Comment 5 Florian Weimer 2017-10-07 11:08:48 UTC
Still not fixed in F26.  Needs backporting to F25 as well.

Comment 6 Florian Weimer 2017-10-07 12:04:18 UTC
Now fixed upstream on the 2.25 and 2.24 release branches.

Comment 7 Fedora Update System 2017-10-09 14:51:53 UTC
glibc-2.25-11.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-2c63df4fe3

Comment 8 Fedora Update System 2017-10-11 02:52:58 UTC
glibc-2.25-11.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-2c63df4fe3

Comment 9 Fedora Update System 2017-10-11 16:17:42 UTC
glibc-2.25-12.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-2c63df4fe3

Comment 10 Fedora Update System 2017-10-13 04:21:34 UTC
glibc-2.25-12.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-2c63df4fe3

Comment 11 Fedora Update System 2017-10-25 23:09:03 UTC
glibc-2.25-12.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.