Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Recently I've got a sigsegv of rsync rebuilt from RH 7 src.rpm, reported by abrt However, it looks like the same problem can appear with any modern version.
The problem lies in the following line:
rsync.c:408:
if (i < 0 || !S_ISREG(cur_flist->files[i]->mode)) {
What we expect to get in cur_flist->files[i] if 'i < 0' ?
It is very likely that we will not have any access violation, but in my case I was unlucky and got sigsegv with i == -1:
Backtrace:
Program terminated with signal 11, Segmentation fault.
#0 read_ndx_and_attrs (f_in=f_in@entry=3, f_out=f_out@entry=3, iflag_ptr=iflag_ptr@entry=0x7ffef8f60488, type_ptr=type_ptr@entry=0x7ffef8f60487 "\200\b", buf=buf@entry=0x7ffef8f61520 "", len_ptr=len_ptr@entry=0x7ffef8f6048c)
at rsync.c:408
408 struct file_struct *file = cur_flist->files[i];
(gdb) bt
#0 read_ndx_and_attrs (f_in=f_in@entry=3, f_out=f_out@entry=3, iflag_ptr=iflag_ptr@entry=0x7ffef8f60488, type_ptr=type_ptr@entry=0x7ffef8f60487 "\200\b", buf=buf@entry=0x7ffef8f61520 "", len_ptr=len_ptr@entry=0x7ffef8f6048c)
at rsync.c:408
#1 0x00005581443857b5 in send_files (f_in=f_in@entry=3, f_out=f_out@entry=3) at sender.c:218
#2 0x000055814438f621 in client_run (f_in=3, f_out=3, pid=pid@entry=-1, argc=argc@entry=1, argv=argv@entry=0x5581446cb240) at main.c:1167
#3 0x00005581443b35da in start_socket_client (host=<optimized out>, remote_argc=remote_argc@entry=1, remote_argv=remote_argv@entry=0x5581446cb248, argc=argc@entry=1, argv=argv@entry=0x5581446cb240) at clientserver.c:133
#4 0x0000558144372404 in start_client (argv=0x5581446cb240, argc=1) at main.c:1380
#5 main (argc=2, argv=0x5581446cb240) at main.c:1757
(gdb) p i
$2 = -1
(gdb) p ndx
$3 = 636051
(gdb) p cur_flist->ndx_start;
Invalid character ';' in expression.
(gdb) p cur_flist->ndx_start
$4 = 636052
(gdb)
Hi Denis,
thanks for the report. Is it possible to reproduce this reliably on your side? Seems like the 'i' should be checked '< 0' before the assignment on line 408. But it would be hard to test this unless someone can reproduce this.
Regards,
Michal
I failed to reproduce this up to now. The problem is that files[-1] in most cases point to some memory which is allowed to be access by the process. That area contains some garbage, but this doesn't lead to the process crash.
And yes, check for 'i<0' should be performed in a separate condifiton. I will report it to upstream and send a PR there.
So I took Wayne's patch(basically your patch Denis) and decided to apply it to the copy-devices.diff before using it on code. Not the most brilliant way I am afraid but at least this way I don't have to add new code from the rsync-patches repo and just fix this one issue.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (Moderate: rsync security and bug fix update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHSA-2022:8291
Recently I've got a sigsegv of rsync rebuilt from RH 7 src.rpm, reported by abrt However, it looks like the same problem can appear with any modern version. The problem lies in the following line: rsync.c:408: if (i < 0 || !S_ISREG(cur_flist->files[i]->mode)) { What we expect to get in cur_flist->files[i] if 'i < 0' ? It is very likely that we will not have any access violation, but in my case I was unlucky and got sigsegv with i == -1: Backtrace: Program terminated with signal 11, Segmentation fault. #0 read_ndx_and_attrs (f_in=f_in@entry=3, f_out=f_out@entry=3, iflag_ptr=iflag_ptr@entry=0x7ffef8f60488, type_ptr=type_ptr@entry=0x7ffef8f60487 "\200\b", buf=buf@entry=0x7ffef8f61520 "", len_ptr=len_ptr@entry=0x7ffef8f6048c) at rsync.c:408 408 struct file_struct *file = cur_flist->files[i]; (gdb) bt #0 read_ndx_and_attrs (f_in=f_in@entry=3, f_out=f_out@entry=3, iflag_ptr=iflag_ptr@entry=0x7ffef8f60488, type_ptr=type_ptr@entry=0x7ffef8f60487 "\200\b", buf=buf@entry=0x7ffef8f61520 "", len_ptr=len_ptr@entry=0x7ffef8f6048c) at rsync.c:408 #1 0x00005581443857b5 in send_files (f_in=f_in@entry=3, f_out=f_out@entry=3) at sender.c:218 #2 0x000055814438f621 in client_run (f_in=3, f_out=3, pid=pid@entry=-1, argc=argc@entry=1, argv=argv@entry=0x5581446cb240) at main.c:1167 #3 0x00005581443b35da in start_socket_client (host=<optimized out>, remote_argc=remote_argc@entry=1, remote_argv=remote_argv@entry=0x5581446cb248, argc=argc@entry=1, argv=argv@entry=0x5581446cb240) at clientserver.c:133 #4 0x0000558144372404 in start_client (argv=0x5581446cb240, argc=1) at main.c:1380 #5 main (argc=2, argv=0x5581446cb240) at main.c:1757 (gdb) p i $2 = -1 (gdb) p ndx $3 = 636051 (gdb) p cur_flist->ndx_start; Invalid character ';' in expression. (gdb) p cur_flist->ndx_start $4 = 636052 (gdb)