+++ This bug was initially created as a clone of Bug #2061727 +++

From the upstream bug report:

This originated in a downstream bug report. The slightly incorrect reproducer looks like this:

#include <sys/types.h>
#include <pwd.h>
#include <errno.h>
#include <stdio.h>

int main(void)
{
    struct passwd *pw;
    errno = 0;
    setpwent();
    while ((pw = getpwent()) != NULL) {
        errno = 0;
        printf("%d: %s\n", pw->pw_uid, pw->pw_name);
    }
    printf("getpwent errno = %d (%m)\n", errno);
    endpwent();
    return 0;
}

(The upstream commit includes a proper test.)

And the last NSS module has an ELF constructor that clobbers errno, but its lookup function does not return any data. The errno value from the ELF constructor then leaks into the getpwent result.

Upstream commit (already backported to 2.34):

commit 9bdf92c79d63b42f931101bb6df87129c408b0c4
Author: Florian Weimer <fweimer>
Date:   Fri Mar 11 08:23:56 2022 +0100

    nss: Protect against errno changes in function lookup (bug 28953)
    
    dlopen may clobber errno.  The nss_test_errno module uses an ELF
    constructor to achieve that, but there could be internal errors
    during dlopen that cause this, too.  Therefore, the NSS framework
    has to guard against such errno clobbers.
    
    __nss_module_get_function is currently the only function that calls
    __nss_module_load, so it is sufficient to save and restore errno
    around this call.
    
    Reviewed-by: Carlos O'Donell <carlos>