+++ This bug was initially created as a clone of Bug #1463692 +++ Sergey Kolosov discovered that the NSS group merge feature (added in bug 1298975) does not work on ppc64 and s390x. The cause seems to be this code in grp/grp-merge.c: /* Copy the pointers from the members array into the buffer and assign them to the gr_mem member of destgrp. */ destgrp->gr_mem = (char **) &destbuf[c]; len = sizeof (char *) * (memcount + 1); BUFCHECK (len); memcpy (&destbuf[c], members, len); c += len; free (members); members = NULL; After the assigned to destgrp->gr_mem, we have: (gdb) print destbuf $1 = 0x10031000 "groupa" (gdb) print c $2 = 21 (gdb) print destgrp->gr_mem $3 = (char **) 0x10031015 This pointer is not suitable aligned, and this triggers undefined behavior. We should switch this code over to the allocation buffer interface, which deals with exactly this kind of problem. --- Additional comment from Carlos O'Donell on 2017-06-21 16:47:50 CEST --- Correct, gr_mem is not sufficiently aligned at the start. On pcc64 any * must be doubleword aligned (8 bytes). On s390 any * must be word aligned (4 bytes). These are just natural alignment rules.
This needs to be backported to Fedora 25 and Fedora 26.
This is fixed on upstream master now. commit f8cef4d07d9641e27629bd3ce2d13f5d702fb251 Author: DJ Delorie <dj> Date: Wed Jul 19 13:14:34 2017 -0400 Fix cast-after-dereference Original code was dereferencing a char*, then casting the value to size_t. Should cast the pointer to size_t* then deference. commit 4fa8ae49aa169fb8d97882938e8bee3ed9ce5410 Author: DJ Delorie <dj> Date: Fri Jul 14 21:46:42 2017 -0400 Fix BZ #21654 - grp-merge.c alignment * grp/grp_merge.c (__copy_grp): Align char** to minimum pointer alignment not char alignment. (__merge_grp): Likewise.
This bug appears to have been reported against 'rawhide' during the Fedora 27 development cycle. Changing version to '27'.
Still not fixed in F26. Needs backporting to F25 as well.
Now fixed upstream on the 2.25 and 2.24 release branches.
glibc-2.25-11.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-2c63df4fe3
glibc-2.25-11.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-2c63df4fe3
glibc-2.25-12.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-2c63df4fe3
glibc-2.25-12.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-2c63df4fe3
glibc-2.25-12.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.