Bug 533367
| Summary: | [RHEL5] Segfault after DNS name resolution | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Tomas Smetana <tsmetana> | ||||||
| Component: | glibc | Assignee: | Andreas Schwab <schwab> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | qe-baseos-tools-bugs | ||||||
| Severity: | high | Docs Contact: | |||||||
| Priority: | high | ||||||||
| Version: | 5.4 | CC: | drepper, ebachalo, fweimer, jbardin, mlichvar, pmuller, rvokal, spoyarek | ||||||
| Target Milestone: | rc | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | i386 | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | glibc-2.5-54 | Doc Type: | Bug Fix | ||||||
| Doc Text: |
Prior to this update, a DNS resolver could fail to report an appropriate error when the supplied buffer was too small. This resulted in a truncated response instead of asking the caller to resize the buffer and try again. With this update, small buffers are handled correctly and the DNS resolver no longer fails.
|
Story Points: | --- | ||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2011-01-14 00:03:24 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
|
Description
Tomas Smetana
2009-11-06 11:53:10 UTC
Created attachment 367818 [details]
Proposed patch
This looks to fix the reproducer in my testing environment. Basically it just tries to detect the empty IPv6 address list and re-run the query for IPv4 if needed. The patch is not very pretty but shows where the problem is.
Just a note. This is probably more a problem of glibc -- the gethostbyname(3) function is deprecated and it's not working well with IPv6. The sole fact that the (hp && !hp->h_addr) condition can be true is not quite OK. I think the correct way of solving the issue would be to replace gethostby* functions by getaddrinfo in sendmail. Sorry, I forgot to mention that the problem is reproducible only on 32-bit x86. Ok, this is really better to fix in glibc. The gethostbyname call should return NULL if there is no address for the name instead of the empty list. It seems to happen only when the DNS response doesn't fit in UDP packet. I cannot reproduce that. Created attachment 368242 [details]
simple reproducer
Hi Andreas, as for the original problem I can't add anything else than what is in the comment #0 (really needs to be reproduced on i386). Mirek had told me he had a simpler reproducer so I asked him to post it here (comment #7). Regards. The problem happens only when all of the following is true: 0) arch is i386 1) response is larger than what would fit in a single dns packet 2) the request is IPv6 3) The dns query is done with tcp (either with a retry or due to RES_USEVC) So if one uses RES_IGNTC in _res.options, this works fine. The result comes out as an IPv4 address formatted as IPv6 -- I'm not sure that is correct either since it's actually returning an IPv4 address. So maybe h_addr_type should be updated? What do you expect from the test case? It fails with return value 1 as I think it should. This is with x86-64 and x86 on F12. The problem is on RHEL-5.4. The difference is in the value returned in hostent under a number of conditions. 1) On x86_64 returns an ipv4 address list inside the hostent object 2) on x86 it returns an empty address list inside the hostent object 3) On x86 with RES_IGNTC it returns the ipv4 list inside the hostent object In all the above cases h_errno is set to 1, so this could be worked around by checking h_errno regardless of the value of hostent. But this breaks applications that assume that a non-null hostent means successful name lookup. The man page sort of leads one to think that way, so I assume there must be a number of such applications out there. gethostbyname seems to behave consistently on my F 11 box for x86 as well as x86_64; fails with h_errno=2 *and* a NULL hostent. But I had got the test case to crash on another F 11 x86 box, so something must have been fixed in F-11. Correction to the F-11 observation I made in comment 11. It does segfault on x86 and gives an incorrect result on x86_64. In both cases h_errno is set to 1 despite the contents of the returned hostent object. My previous observations were probably a result of some DNS server problems since I was testing remotely. *** Bug 545160 has been marked as a duplicate of this bug. ***
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.
New Contents:
Prior to this update, a DNS resolver could fail to report an appropriate error when the supplied buffer was too small. This resulted in a truncated response instead of asking the caller to resize the buffer and try again. With this update, small buffers are handled correctly and the DNS resolver no longer fails.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-0109.html |