Bug 1963710 - glibc: static compilation segfaults with getpwuid(500)
Summary: glibc: static compilation segfaults with getpwuid(500)
Keywords:
Status: CLOSED UPSTREAM
Alias: None
Product: Fedora
Classification: Fedora
Component: glibc
Version: 34
Hardware: Unspecified
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Carlos O'Donell
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-05-23 15:46 UTC by Andrew G. Morgan
Modified: 2021-06-01 13:42 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2021-06-01 13:42:45 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Sourceware 20802 0 P2 RESOLVED getauxval NULL pointer dereference after static dlopen 2021-05-25 14:48:50 UTC
Sourceware 26729 0 P2 NEW Dynamic TLS variables do not work after static dlopen 2021-05-25 14:52:39 UTC

Description Andrew G. Morgan 2021-05-23 15:46:25 UTC
Description of problem:

When compiled statically, getpwuid(unnamed_uid), causes a program to core dump.

Note: This bug is a re-filing of this one:

  https://bugzilla.redhat.com/show_bug.cgi?id=1842745

That other bug was closed as fixed in F33, but while it may have fixed something upstream, it hasn't actually fixed the reason the bug was filed. So I'm filing this one.

Version-Release number of selected component (if applicable):

$ rpm -q glibc
glibc-2.33-8.fc34.x86_64

How reproducible:

100%

Steps to Reproduce:

1. create this program:

/* === bug.c === */

#include <stdio.h>
#include <sys/types.h>
#include <pwd.h>

int main(int argc, char **argv) {
  printf("call for uid=1 returns: %p\n", getpwuid(1));
  printf("call for uid=500 returns: %p\n", getpwuid(500));
}

/* ============= */

2. Compile it as follows:

gcc --static bug.c -o bug

3. run it

Actual results:

$ ./bug 
call for uid=1 returns: 0x4bd200
Segmentation fault (core dumped)

Expected results:

$ ./bug 
call for uid=1 returns: 0x4bd200
call for uid=500 returns: (nil)

Additional info:

$ gcc -g --static bug.c -o bug
$ gdb ./bug
(gdb) run
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7f0029b in getauxval () from /lib64/libc.so.6
(gdb)  bt
#0  0x00007ffff7f0029b in getauxval () from /lib64/libc.so.6
#1  0x00007ffff6fbe80c in parse_environ_flags.lto_priv ()
   from /lib64/libp11-kit.so.0
#2  0x00007ffff6f291ad in _p11_kit_init () from /lib64/libp11-kit.so.0
#3  0x00000000004879de in call_init ()
#4  0x0000000000487acc in _dl_init ()
#5  0x000000000044ea15 in _dl_catch_exception ()
#6  0x000000000047747a in dl_open_worker ()
#7  0x000000000044e9b8 in _dl_catch_exception ()
#8  0x0000000000476d49 in _dl_open ()
#9  0x000000000044d506 in do_dlopen ()
#10 0x000000000044e9b8 in _dl_catch_exception ()
#11 0x000000000044ea83 in _dl_catch_error ()
#12 0x000000000044d547 in dlerror_run ()
#13 0x000000000044d9fa in __libc_dlopen_mode ()
#14 0x0000000000448db0 in module_load ()
#15 0x00000000004491f5 in __nss_module_get_function ()
#16 0x0000000000448baf in __nss_next2 ()
#17 0x0000000000445a20 in getpwuid_r ()
#18 0x000000000044580b in getpwuid ()
#19 0x00000000004017ba in main (argc=1, argv=0x7fffffffddc8) at bug.c:7

Comment 1 Florian Weimer 2021-05-23 17:01:53 UTC
Would you please check which NSS modules are listed for passwd in /etc/nsswitch.conf and report them here? Thanks.

Comment 2 Andrew G. Morgan 2021-05-24 01:45:05 UTC
I believe I have whatever the default install provides:

$ grep -v '^#' /etc/nsswitch.conf

passwd:     sss files systemd
group:      sss files systemd
netgroup:   sss files
automount:  sss files
services:   sss files



shadow:     files sss
hosts:      files myhostname mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns

aliases:    files
ethers:     files
gshadow:    files
networks:   files dns
protocols:  files
publickey:  files
rpc:        files
$

Comment 3 Florian Weimer 2021-05-25 14:03:54 UTC
I've got a fix for the crash in _p11_kit_init. However, there is anothe rcrash in nss_systemd in TLS access which will need a totally different fix.

Comment 4 Florian Weimer 2021-05-25 14:52:43 UTC
I looked at the crash site and it's the __tls_get_addr issue.

Comment 5 Carlos O'Donell 2021-06-01 13:42:45 UTC
We are going to be tracking this issue upstream here:
https://sourceware.org/bugzilla/show_bug.cgi?id=26729

I am marking this CLOSED/UPSTREAM. We can review this again when we fix it upstream.

We know that it affects the use case of a static binary needing to access identity data.

We will review the upstream issue and backport as required to enable the fix in Fedora.

We need this fixed upstream first before it can be fixed downstream.


Note You need to log in before you can comment on or make changes to this bug.