Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 601140 - hal-disable-polling segfaults on a symlink
hal-disable-polling segfaults on a symlink
Status: CLOSED DUPLICATE of bug 592403
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: hal (Show other bugs)
6.0
All Linux
low Severity medium
: rc
: ---
Assigned To: Richard Hughes
desktop-bugs@redhat.com
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-06-07 06:15 EDT by Gordan Bobic
Modified: 2010-06-21 14:11 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-06-21 14:11:40 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Gordan Bobic 2010-06-07 06:15:14 EDT
Description of problem:
When hal-disable-polling is invoked on a symlink, a buffer-overflow causes a segfault.

Version-Release number of selected component (if applicable):
hal-0.5.14-1.el6.x86_64

How reproducible:
Every time.

Steps to Reproduce:
hal-disable-polling --device /dev/cdrom
  
Actual results:
*** buffer overflow detected ***: hal-disable-polling terminated
======= Backtrace: =========
/lib64/libc.so.6(__fortify_fail+0x37)[0x34620f7687]
/lib64/libc.so.6[0x34620f56a0]
/lib64/libc.so.6[0x34620f5cfb]
hal-disable-polling[0x40148b]
/lib64/libc.so.6(__libc_start_main+0xfd)[0x346201eb1d]
hal-disable-polling[0x400e49]
======= Memory map: ========
00400000-00403000 r-xp 00000000 08:02 1555886                            /usr/bin/hal-disable-polling
00602000-00603000 rw-p 00002000 08:02 1555886                            /usr/bin/hal-disable-polling
013b0000-013d1000 rw-p 00000000 00:00 0                                  [heap]
3461800000-346181e000 r-xp 00000000 08:02 1571141                        /lib64/ld-2.11.1.so
3461a1d000-3461a1e000 r--p 0001d000 08:02 1571141                        /lib64/ld-2.11.1.so
3461a1e000-3461a1f000 rw-p 0001e000 08:02 1571141                        /lib64/ld-2.11.1.so
3461a1f000-3461a20000 rw-p 00000000 00:00 0 
3462000000-3462170000 r-xp 00000000 08:02 1571142                        /lib64/libc-2.11.1.so
3462170000-346236f000 ---p 00170000 08:02 1571142                        /lib64/libc-2.11.1.so
346236f000-3462373000 r--p 0016f000 08:02 1571142                        /lib64/libc-2.11.1.so
3462373000-3462374000 rw-p 00173000 08:02 1571142                        /lib64/libc-2.11.1.so
3462374000-3462379000 rw-p 00000000 00:00 0 
3462800000-3462817000 r-xp 00000000 08:02 1571150                        /lib64/libpthread-2.11.1.so
3462817000-3462a16000 ---p 00017000 08:02 1571150                        /lib64/libpthread-2.11.1.so
3462a16000-3462a17000 r--p 00016000 08:02 1571150                        /lib64/libpthread-2.11.1.so
3462a17000-3462a18000 rw-p 00017000 08:02 1571150                        /lib64/libpthread-2.11.1.so
3462a18000-3462a1c000 rw-p 00000000 00:00 0 
3463000000-3463007000 r-xp 00000000 08:02 1571160                        /lib64/librt-2.11.1.so
3463007000-3463206000 ---p 00007000 08:02 1571160                        /lib64/librt-2.11.1.so
3463206000-3463207000 r--p 00006000 08:02 1571160                        /lib64/librt-2.11.1.so
3463207000-3463208000 rw-p 00007000 08:02 1571160                        /lib64/librt-2.11.1.so
3463800000-34638e4000 r-xp 00000000 08:02 1571156                        /lib64/libglib-2.0.so.0.2200.3
34638e4000-3463ae4000 ---p 000e4000 08:02 1571156                        /lib64/libglib-2.0.so.0.2200.3
3463ae4000-3463ae5000 rw-p 000e4000 08:02 1571156                        /lib64/libglib-2.0.so.0.2200.3
3463ae5000-3463ae6000 rw-p 00000000 00:00 0 
3465800000-346583f000 r-xp 00000000 08:02 1571164                        /lib64/libdbus-1.so.3.4.0
346583f000-3465a3f000 ---p 0003f000 08:02 1571164                        /lib64/libdbus-1.so.3.4.0
3465a3f000-3465a40000 r--p 0003f000 08:02 1571164                        /lib64/libdbus-1.so.3.4.0
3465a40000-3465a41000 rw-p 00040000 08:02 1571164                        /lib64/libdbus-1.so.3.4.0
346bc00000-346bc10000 r-xp 00000000 08:02 1613175                        /usr/lib64/libhal.so.1.0.0
346bc10000-346be0f000 ---p 00010000 08:02 1613175                        /usr/lib64/libhal.so.1.0.0
346be0f000-346be10000 rw-p 0000f000 08:02 1613175                        /usr/lib64/libhal.so.1.0.0
7f9253e2f000-7f9253e45000 r-xp 00000000 08:02 1571162                    /lib64/libgcc_s-4.4.3-20100121.so.1
7f9253e45000-7f9254044000 ---p 00016000 08:02 1571162                    /lib64/libgcc_s-4.4.3-20100121.so.1
7f9254044000-7f9254045000 rw-p 00015000 08:02 1571162                    /lib64/libgcc_s-4.4.3-20100121.so.1
7f9254045000-7f925404a000 rw-p 00000000 00:00 0 
7f925405d000-7f925405e000 rw-p 00000000 00:00 0 
7fff68202000-7fff68217000 rw-p 00000000 00:00 0                          [stack]
7fff68249000-7fff6824a000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Aborted (core dumped)


Additional info:
Calling the same command on the device node the link points to works:
# hal-disable-polling --device /dev/sr0
Polling for drive /dev/sr0 have been disabled. The fdi file written was
  /etc/hal/fdi/information/media-check-disable-storage_model_DVD_RAM_UJ_842.fdi
Comment 2 RHEL Product and Program Management 2010-06-07 13:03:46 EDT
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.
Comment 3 Matthias Clasen 2010-06-21 14:11:40 EDT

*** This bug has been marked as a duplicate of bug 592403 ***

Note You need to log in before you can comment on or make changes to this bug.