Bug 1895387
| Summary: | telnet crashes on stack overflow due to infinite recursion | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Renaud Métrich <rmetrich> | ||||
| Component: | telnet | Assignee: | Michal Ruprich <mruprich> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Patrik Moško <pmosko> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 8.3 | CC: | mruprich, pmosko, psklenar | ||||
| Target Milestone: | rc | Keywords: | Patch, Reproducer, TestCaseNeeded, Triaged | ||||
| Target Release: | 8.0 | Flags: | pm-rhel:
mirror+
|
||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | telnet-0.17-76.el8 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2021-05-18 15:38:11 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Renaud Métrich
2020-11-06 14:44:45 UTC
Another reproducer is like this: # telnet localhost | cat (login) # yes y y y ... (segfault) qe triage: reproducer is +- clear but what should be new behavior? error message and end? warning and continue (2x cmd like cat, the first is killed ? ) # lets expect 22 is running sshd telnet localhost 22 | cat & kill -9 `pidof cat` OLD: telnet crashed as coredumpctl list dump telnet NEW: whats expected here ? telnet ends with error message? Hi Petr, I think that I would like to achieve the same behaviour that you get when you kill the server side. For instance if you run telnet without the pipeline and then kill the login process from another terminal, you get this: # telnet localhost Trying ::1... Connected to localhost. Escape character is '^]'. Kernel 4.18.0-240.10.el8.x86_64 on an x86_64 ci-vm-10-0-137-223 login: Connection closed by foreign host. I am working on this but still I am unsure how to fix this correctly. Scoped, as per discussion with Michal, setting ITM to 10. I can see few potential ways of reproducing this so there shouldn't be any issue with providing reliable test. So I get the gist of the problem here. Before the signal handler for SIGPIPE is set, sigsetjmp(peerdied, 1) is set on line 2509 in commands.c. When SIGPIPE is delivered by the system, function deadpeer is the handler and it calls the siglongjmp(peerdier, -1) so it should jump right after the sigsetjmp. The problem is that there is a buffer that tries to flush itself out before ending. But the other end is still broken so the SIGPIPE is raised again. That goes into a loop, calling the handler over and over. The problem here might probably be in the signal() system call. It does not restore the default behaviour after signal has been raised. The sigsetjmp function is called before setting up the signal for SIGPIPE so I thought that the default behaviour for SIGPIPE should be restored when the jump is performed but it is not. I think that the solution should be to simply revert the handling to default directly in the handler so that if telnet tries to empty some buffer after the pipe is gone, it should die on the default SIGPIPE behaviour. Created attachment 1728798 [details]
Possible patch
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (telnet bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:1799 The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days |