Bug 1471985 - glibc: Incorrect pointer alignment in NSS group merge result construction
glibc: Incorrect pointer alignment in NSS group merge result construction
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: glibc (Show other bugs)
27
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Florian Weimer
Fedora Extras Quality Assurance
:
Depends On:
Blocks: 1463692
  Show dependency treegraph
 
Reported: 2017-07-17 17:03 EDT by Florian Weimer
Modified: 2018-01-12 05:25 EST (History)
8 users (show)

See Also:
Fixed In Version: glibc-2.25.90-26.fc27
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1463692
Environment:
Last Closed: 2018-01-12 05:25:37 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Sourceware 21654 None None None 2017-07-17 17:03 EDT

  None (edit)
Description Florian Weimer 2017-07-17 17:03:05 EDT
+++ This bug was initially created as a clone of Bug #1463692 +++

Sergey Kolosov discovered that the NSS group merge feature (added in bug 1298975) does not work on ppc64 and s390x.  The cause seems to be this code in grp/grp-merge.c:

  /* Copy the pointers from the members array into the buffer and assign them
     to the gr_mem member of destgrp.  */
  destgrp->gr_mem = (char **) &destbuf[c];
  len = sizeof (char *) * (memcount + 1);
  BUFCHECK (len);
  memcpy (&destbuf[c], members, len);
  c += len;
  free (members);
  members = NULL;

After the assigned to destgrp->gr_mem, we have:

(gdb) print destbuf
$1 = 0x10031000 "groupa"
(gdb) print c
$2 = 21
(gdb) print destgrp->gr_mem
$3 = (char **) 0x10031015

This pointer is not suitable aligned, and this triggers undefined behavior.

We should switch this code over to the allocation buffer interface, which deals with exactly this kind of problem.

--- Additional comment from Carlos O'Donell on 2017-06-21 16:47:50 CEST ---

Correct, gr_mem is not sufficiently aligned at the start.

On pcc64 any * must be doubleword aligned (8 bytes).
On s390 any * must be word aligned (4 bytes).

These are just natural alignment rules.
Comment 1 Florian Weimer 2017-07-17 17:03:33 EDT
This needs to be backported to Fedora 25 and Fedora 26.
Comment 2 Carlos O'Donell 2017-07-20 04:57:34 EDT
This is fixed on upstream master now.

commit f8cef4d07d9641e27629bd3ce2d13f5d702fb251
Author: DJ Delorie <dj@delorie.com>
Date:   Wed Jul 19 13:14:34 2017 -0400

    Fix cast-after-dereference
    
    Original code was dereferencing a char*, then casting the value
    to size_t.  Should cast the pointer to size_t* then deference.

commit 4fa8ae49aa169fb8d97882938e8bee3ed9ce5410
Author: DJ Delorie <dj@delorie.com>
Date:   Fri Jul 14 21:46:42 2017 -0400

    Fix BZ #21654 - grp-merge.c alignment
    
    * grp/grp_merge.c (__copy_grp): Align char** to minimum pointer
    alignment not char alignment.
    (__merge_grp): Likewise.
Comment 3 Jan Kurik 2017-08-15 03:21:11 EDT
This bug appears to have been reported against 'rawhide' during the Fedora 27 development cycle.
Changing version to '27'.
Comment 5 Florian Weimer 2017-10-07 07:08:48 EDT
Still not fixed in F26.  Needs backporting to F25 as well.
Comment 6 Florian Weimer 2017-10-07 08:04:18 EDT
Now fixed upstream on the 2.25 and 2.24 release branches.
Comment 7 Fedora Update System 2017-10-09 10:51:53 EDT
glibc-2.25-11.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-2c63df4fe3
Comment 8 Fedora Update System 2017-10-10 22:52:58 EDT
glibc-2.25-11.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-2c63df4fe3
Comment 9 Fedora Update System 2017-10-11 12:17:42 EDT
glibc-2.25-12.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-2c63df4fe3
Comment 10 Fedora Update System 2017-10-13 00:21:34 EDT
glibc-2.25-12.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-2c63df4fe3
Comment 11 Fedora Update System 2017-10-25 19:09:03 EDT
glibc-2.25-12.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.