Bug 2157659

This bug was initially created as a copy of Bug #2157658

I am copying this bug because: 

Also applies, reading the code.


Description of problem:

A customer sees regularly crashes of *rsyslogd* when the process exits.
This happens because of a bug in *imklog* (which is disabled by default now, but not on customer's system):
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
(gdb) bt
#0  __GI___libc_free (mem=0x203a226c6e5f7361) at malloc.c:3110
#1  0x00007f692f03633f in modExit () at imklog.c:478
#2  0x000055be3605ff97 in modPrepareUnload (pThis=0x55be3707b4f0) at modules.c:555
#3  modUnlinkAndDestroy (ppThis=ppThis@entry=0x7ffeec6cd1f0) at modules.c:1008
#4  0x000055be36060198 in modUnloadAndDestructAll (modLinkTypesToUnload=eMOD_LINK_ALL) at modules.c:1033
#5  0x000055be36023f94 in deinitAll () at rsyslogd.c:2074
#6  main (argc=<optimized out>, argv=0x7ffeec6cd418) at rsyslogd.c:2155

(gdb) f 3
#3  modUnlinkAndDestroy (ppThis=ppThis@entry=0x7ffeec6cd1f0) at modules.c:1008
1008            CHKiRet(modPrepareUnload(pThis));
(gdb) p *pThis
$1 = {pPrev = 0x55be370611e0, pNext = 0x55be3707c7d0, iIFVers = 6, eType = eMOD_IN, 
  eLinkType = eMOD_LINK_DYNAMIC_LOADED, eKeepType = eMOD_NOKEEP, pszName = 0x55be3707c020 "imklog", 
  cnfName = 0x55be3707c000 "imklog", uRefCnt = 0, bSetModCnfCalled = 1 '\001', modInit = 0x0, 
  modQueryEtryPt = 0x7f692f035bc0 <queryEtryPt>, 
  isCompatibleWithFeature = 0x55be3605ee40 <dummyIsCompatibleWithFeature>, freeInstance = 0x0, 
  dbgPrintInstInfo = 0x0, tryResume = 0x0, modExit = 0x7f692f036310 <modExit>, modGetID = 0x7f692f035b10 <modGetID>, 
  doHUP = 0x0, doHUPWrkr = 0x0, beginCnfLoad = 0x7f692f036430 <beginCnfLoad>, 
  setModCnf = 0x7f692f035f40 <setModCnf>, endCnfLoad = 0x7f692f036260 <endCnfLoad>, 
  checkCnf = 0x7f692f035eb0 <checkCnf>, activateCnfPrePrivDrop = 0x7f692f035ea0 <activateCnfPrePrivDrop>, 
  activateCnf = 0x7f692f0365a0 <activateCnf>, freeCnf = 0x7f692f036230 <freeCnf>, mod = {im = {
      willRun = 0x7f692f036530 <willRun>, runInput = 0x7f692f036560 <runInput>, 
      afterRun = 0x7f692f036500 <afterRun>, newInpInst = 0x0, bCanRun = 0}, om = {
      beginTransaction = 0x7f692f036530 <willRun>, commitTransaction = 0x7f692f036560 <runInput>, 
      doAction = 0x7f692f036500 <afterRun>, endTransaction = 0x0, parseSelectorAct = 0x0, newActInst = 0x0, 
      SetShutdownImmdtPtr = 0x0, createWrkrInstance = 0x0, freeWrkrInstance = 0x0, supportsTX = 0 '\000'}, lm = {
      dummy = 48 '0'}, pm = {newParserInst = 0x7f692f036530 <willRun>, freeParserInst = 0x7f692f036560 <runInput>, 
      parse2 = 0x7f692f036500 <afterRun>, parse = 0x0}, sm = {strgen = 0x7f692f036530 <willRun>}, fm = {
      getFunctArray = 0x7f692f036530 <willRun>}}, pModHdlr = 0x55be3707af30} 
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Through rebuilding with ASAN support, ASAN reported the issue:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
==53456==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000032cf8 at pc 0x7f0e62c03939 bp 0x7fff175ccf10 sp 0x7fff175ccf00
READ of size 8 at 0x606000032cf8 thread T0
    #0 0x7f0e62c03938  (/usr/lib64/rsyslog/imklog.so+0xc938)
    #1 0x55f8081aa510 in modPrepareUnload modules.c:555
    #2 0x55f8081aa510 in modUnlinkAndDestroy modules.c:1008
    #3 0x55f8081ab1a8 in modUnloadAndDestructAll modules.c:1033
    #4 0x55f8080b0eca in deinitAll rsyslogd.c:2074
    #5 0x7f0e68ca7d84 in __libc_start_main (/lib64/libc.so.6+0x3ad84)
    #6 0x55f8080a6dbd in _start (/usr/sbin/rsyslogd+0x2d0dbd)

0x606000032cf8 is located 56 bytes inside of 64-byte region [0x606000032cc0,0x606000032d00)
freed by thread T0 here:
    #0 0x7f0e6b2037e0 in __interceptor_free (/lib64/libasan.so.5+0xef7e0)
    #1 0x7f0e62c0349c  (/usr/lib64/rsyslog/imklog.so+0xc49c)

previously allocated by thread T0 here:
    #0 0x7f0e6b203db0 in calloc (/lib64/libasan.so.5+0xefdb0)
    #1 0x7f0e62c03b7d  (/usr/lib64/rsyslog/imklog.so+0xcb7d)

SUMMARY: AddressSanitizer: heap-use-after-free (/usr/lib64/rsyslog/imklog.so+0xc938)
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

The root cause is reading deallocated memory on line 478:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
454 BEGINfreeCnf
455 CODESTARTfreeCnf
456 ENDfreeCnf
 :
473 BEGINmodExit
474 CODESTARTmodExit
475         if(pInputName != NULL)
476                 prop.Destruct(&pInputName);
477 
478         free(runModConf->pszBindRuleset);
479         /* release objects we used */
480         objRelease(glbl, CORE_COMPONENT);
481         objRelease(net, CORE_COMPONENT);
482         objRelease(datetime, CORE_COMPONENT);
483         objRelease(ruleset, CORE_COMPONENT);
484         objRelease(prop, CORE_COMPONENT);
485 ENDmodExit
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

At the time of exit, the "runModConf" memory has already been freed. The memory has to be freed in freeCnf() instead (line 455).
This was fixed by Upstream commit 1cc2c66d7d5234ed0aa70155a0755c2f59ca20f1.

Version-Release number of selected component (if applicable):

rsyslogd RHEL8 and RHEL9

How reproducible:

Sometimes

Steps to Reproduce:
1. Enable imklog
2. Restart rsyslog service repeatedly

Actual results:

Some crashes

Expected results:

No crash