Bug 684037

Summary: improperly used readlink() in util-linux-ng-2.17-lsblk.patch
Product: Red Hat Enterprise Linux 6 Reporter: Kamil Dudka <kdudka>
Component: util-linux-ngAssignee: Karel Zak <kzak>
Status: CLOSED ERRATA QA Contact: Petr Sklenar <psklenar>
Severity: low Docs Contact:
Priority: unspecified    
Version: 6.1CC: psklenar, rvokal
Target Milestone: rcKeywords: Reopened
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-05-19 14:06:57 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Attachments:
Description Flags
a reproducer none

Description Kamil Dudka 2011-03-10 22:59:22 UTC 
Description of problem:
- off-by-one error in the bufsize parameter given to readlink()
- broken error handling (len < 0 comparison of unsigned variable by is useless)


Version-Release number of selected component (if applicable):
util-linux-ng-2.17.2-9.el6
Comment 4 Karel Zak 2011-03-11 09:37:01 UTC 
The latest RHEL61 built is util-linux-ng-2.17.2-11.el6, the package was already reviewed and the bugs fixed....

See https://bugzilla.redhat.com/show_bug.cgi?id=678378

*** This bug has been marked as a duplicate of bug 678378 ***
Comment 5 Karel Zak 2011-03-11 09:46:02 UTC 
Ah... the problem with size_t vs. ssize_t should be probably fixed.
Comment 7 Kamil Dudka 2011-04-19 11:49:16 UTC 
Created attachment 493166 [details]
a reproducer
Comment 8 Kamil Dudka 2011-04-19 11:51:36 UTC 
$ curl -o bz684037.c 'https://bugzilla.redhat.com/attachment.cgi?id=493166'
$ sh bz684037.c
...
bz684037.c: line 4: 31309 Segmentation fault      LD_PRELOAD=./readlink.so valgrind namei lnk

With the fixed version, it gives me:
namei: failed to read symlink: lnk: Success
Comment 9 Kamil Dudka 2011-04-19 11:55:09 UTC 
(In reply to comment #8)
> With the fixed version, it gives me:
> namei: failed to read symlink: lnk: Success

Oops, forgot to set a meaningful errno...

--- a/bz684037.c
+++ b/bz684037.c
@@ -5,6 +5,7 @@
 exit $?
 #endif
 #include <unistd.h>
+#include <errno.h>

 ssize_t readlink(const char *path, char *buf, size_t bufsize)
 {
@@ -12,5 +13,6 @@
     (void) buf;
     (void) bufsize;

+    errno = EPERM;
     return -1;
 }

With the patch above, it says:

namei: failed to read symlink: lnk: Operation not permitted
Comment 11 errata-xmlrpc 2011-05-19 14:06:57 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0699.html