Bug 493578 - ss utility, iproute2-ss061002 - Segmentation fault
Summary: ss utility, iproute2-ss061002 - Segmentation fault
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: iproute
Version: 5.3
Hardware: All
OS: Linux
low
low
Target Milestone: rc
: ---
Assignee: Marcela Mašláňová
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
: 493622 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-04-02 10:41 UTC by Mihail Peltekov
Modified: 2018-10-27 15:02 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-10-21 11:04:45 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
Upstream commit git 69cae645b28edbba53c8601ddeba01430e5e9da0 (1.80 KB, patch)
2009-04-07 14:11 UTC, Marcela Mašláňová
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
CentOS 3475 0 None None None Never
Red Hat Product Errata RHBA-2009:1520 0 normal SHIPPED_LIVE iproute bug fix update 2009-10-21 11:04:44 UTC

Description Mihail Peltekov 2009-04-02 10:41:39 UTC
when i type
[root@myserver ~]# ss
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 0 10.1.0.12:ssh x.x.x.x:4172
ESTAB 0 0 10.1.0.12:mysql 10.1.0.11:34003
Segmentation fault
[root@myserver ~]#

When ipv6 is off 

close(4) = 0
open("/proc/net/tcp6", O_RDONLY) = -1 ENOENT (No such file or directory)
--- SIGSEGV (Segmentation fault) @ 0 (0) ---


I try this on i386 and x86_64 and is the same error

Comment 1 Mihail Peltekov 2009-04-02 10:47:42 UTC
http://bugs.centos.org/view.php?id=3475

Comment 2 Marcela Mašláňová 2009-04-07 09:27:26 UTC
*** Bug 493622 has been marked as a duplicate of this bug. ***

Comment 3 Marcela Mašláňová 2009-04-07 14:09:46 UTC
You can use for the meantime: "ss -f inet"

After fixing previous problem "not showing all socket states" #446198 with upstream commit ab01dbbb94b8620c2bc85e30e107c3a9f0870a73 show up different bugs. On RHEL-5 machine could be seen this one, which could be fixed by upstream commit:
69cae645b28edbba53c8601ddeba01430e5e9da0

Comment 4 Marcela Mašláňová 2009-04-07 14:11:31 UTC
Created attachment 338509 [details]
Upstream commit git 69cae645b28edbba53c8601ddeba01430e5e9da0

Comment 7 Roberto 2009-06-08 22:14:23 UTC
In the function:

static FILE *generic_proc_open(const char *env, const char *name)
{
        char store[128];
        const char *p = getenv(env);
        FILE *fp;
        if (!p) {
                p = getenv("PROC_ROOT") ? : "/proc";
                snprintf(store, sizeof(store)-1, "%s/%s", p, name);
                p = store;
        }

        return fopen(p, "r");
}

PROC_ROOT can be something longer than 128 and cause other segfault.

Comment 8 Marcela Mašláňová 2009-06-09 06:20:26 UTC
(In reply to comment #7)
> In the function:
> 
> static FILE *generic_proc_open(const char *env, const char *name)
> {
>         char store[128];
>         const char *p = getenv(env);
>         FILE *fp;
>         if (!p) {
>                 p = getenv("PROC_ROOT") ? : "/proc";
>                 snprintf(store, sizeof(store)-1, "%s/%s", p, name);
>                 p = store;
>         }
> 
>         return fopen(p, "r");
> }
> 
> PROC_ROOT can be something longer than 128 and cause other segfault.  

If you have a reproducer for this problem, then please open a new bug. This is different problem.

Comment 9 Roberto 2009-06-09 07:55:40 UTC
(In reply to comment #8)
> (In reply to comment #7)
> > In the function:
> > 
> > static FILE *generic_proc_open(const char *env, const char *name)
> > {
> >         char store[128];
> >         const char *p = getenv(env);
> >         FILE *fp;
> >         if (!p) {
> >                 p = getenv("PROC_ROOT") ? : "/proc";
> >                 snprintf(store, sizeof(store)-1, "%s/%s", p, name);
> >                 p = store;
> >         }
> > 
> >         return fopen(p, "r");
> > }
> > 
> > PROC_ROOT can be something longer than 128 and cause other segfault.  
> 
> If you have a reproducer for this problem, then please open a new bug. This is
> different problem.  

I didn't see (i'm blind..) the snprintf out of bound comprobation and the segfault was produced because the content of PROC_ROOT was an invalid path (you fixed it in the last attachment). 

Sorry.

Comment 15 errata-xmlrpc 2009-10-21 11:04:45 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2009-1520.html


Note You need to log in before you can comment on or make changes to this bug.