RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 601140 - hal-disable-polling segfaults on a symlink
Summary: hal-disable-polling segfaults on a symlink
Keywords:
Status: CLOSED DUPLICATE of bug 592403
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: hal
Version: 6.0
Hardware: All
OS: Linux
low
medium
Target Milestone: rc
: ---
Assignee: Richard Hughes
QA Contact: desktop-bugs@redhat.com
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-06-07 10:15 UTC by Gordan Bobic
Modified: 2010-06-21 18:11 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-06-21 18:11:40 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Gordan Bobic 2010-06-07 10:15:14 UTC 
Description of problem:
When hal-disable-polling is invoked on a symlink, a buffer-overflow causes a segfault.

Version-Release number of selected component (if applicable):
hal-0.5.14-1.el6.x86_64

How reproducible:
Every time.

Steps to Reproduce:
hal-disable-polling --device /dev/cdrom
  
Actual results:
*** buffer overflow detected ***: hal-disable-polling terminated
======= Backtrace: =========
/lib64/libc.so.6(__fortify_fail+0x37)[0x34620f7687]
/lib64/libc.so.6[0x34620f56a0]
/lib64/libc.so.6[0x34620f5cfb]
hal-disable-polling[0x40148b]
/lib64/libc.so.6(__libc_start_main+0xfd)[0x346201eb1d]
hal-disable-polling[0x400e49]
======= Memory map: ========
00400000-00403000 r-xp 00000000 08:02 1555886                            /usr/bin/hal-disable-polling
00602000-00603000 rw-p 00002000 08:02 1555886                            /usr/bin/hal-disable-polling
013b0000-013d1000 rw-p 00000000 00:00 0                                  [heap]
3461800000-346181e000 r-xp 00000000 08:02 1571141                        /lib64/ld-2.11.1.so
3461a1d000-3461a1e000 r--p 0001d000 08:02 1571141                        /lib64/ld-2.11.1.so
3461a1e000-3461a1f000 rw-p 0001e000 08:02 1571141                        /lib64/ld-2.11.1.so
3461a1f000-3461a20000 rw-p 00000000 00:00 0 
3462000000-3462170000 r-xp 00000000 08:02 1571142                        /lib64/libc-2.11.1.so
3462170000-346236f000 ---p 00170000 08:02 1571142                        /lib64/libc-2.11.1.so
346236f000-3462373000 r--p 0016f000 08:02 1571142                        /lib64/libc-2.11.1.so
3462373000-3462374000 rw-p 00173000 08:02 1571142                        /lib64/libc-2.11.1.so
3462374000-3462379000 rw-p 00000000 00:00 0 
3462800000-3462817000 r-xp 00000000 08:02 1571150                        /lib64/libpthread-2.11.1.so
3462817000-3462a16000 ---p 00017000 08:02 1571150                        /lib64/libpthread-2.11.1.so
3462a16000-3462a17000 r--p 00016000 08:02 1571150                        /lib64/libpthread-2.11.1.so
3462a17000-3462a18000 rw-p 00017000 08:02 1571150                        /lib64/libpthread-2.11.1.so
3462a18000-3462a1c000 rw-p 00000000 00:00 0 
3463000000-3463007000 r-xp 00000000 08:02 1571160                        /lib64/librt-2.11.1.so
3463007000-3463206000 ---p 00007000 08:02 1571160                        /lib64/librt-2.11.1.so
3463206000-3463207000 r--p 00006000 08:02 1571160                        /lib64/librt-2.11.1.so
3463207000-3463208000 rw-p 00007000 08:02 1571160                        /lib64/librt-2.11.1.so
3463800000-34638e4000 r-xp 00000000 08:02 1571156                        /lib64/libglib-2.0.so.0.2200.3
34638e4000-3463ae4000 ---p 000e4000 08:02 1571156                        /lib64/libglib-2.0.so.0.2200.3
3463ae4000-3463ae5000 rw-p 000e4000 08:02 1571156                        /lib64/libglib-2.0.so.0.2200.3
3463ae5000-3463ae6000 rw-p 00000000 00:00 0 
3465800000-346583f000 r-xp 00000000 08:02 1571164                        /lib64/libdbus-1.so.3.4.0
346583f000-3465a3f000 ---p 0003f000 08:02 1571164                        /lib64/libdbus-1.so.3.4.0
3465a3f000-3465a40000 r--p 0003f000 08:02 1571164                        /lib64/libdbus-1.so.3.4.0
3465a40000-3465a41000 rw-p 00040000 08:02 1571164                        /lib64/libdbus-1.so.3.4.0
346bc00000-346bc10000 r-xp 00000000 08:02 1613175                        /usr/lib64/libhal.so.1.0.0
346bc10000-346be0f000 ---p 00010000 08:02 1613175                        /usr/lib64/libhal.so.1.0.0
346be0f000-346be10000 rw-p 0000f000 08:02 1613175                        /usr/lib64/libhal.so.1.0.0
7f9253e2f000-7f9253e45000 r-xp 00000000 08:02 1571162                    /lib64/libgcc_s-4.4.3-20100121.so.1
7f9253e45000-7f9254044000 ---p 00016000 08:02 1571162                    /lib64/libgcc_s-4.4.3-20100121.so.1
7f9254044000-7f9254045000 rw-p 00015000 08:02 1571162                    /lib64/libgcc_s-4.4.3-20100121.so.1
7f9254045000-7f925404a000 rw-p 00000000 00:00 0 
7f925405d000-7f925405e000 rw-p 00000000 00:00 0 
7fff68202000-7fff68217000 rw-p 00000000 00:00 0                          [stack]
7fff68249000-7fff6824a000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Aborted (core dumped)


Additional info:
Calling the same command on the device node the link points to works:
# hal-disable-polling --device /dev/sr0
Polling for drive /dev/sr0 have been disabled. The fdi file written was
  /etc/hal/fdi/information/media-check-disable-storage_model_DVD_RAM_UJ_842.fdi
Comment 2 RHEL Program Management 2010-06-07 17:03:46 UTC 
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.
Comment 3 Matthias Clasen 2010-06-21 18:11:40 UTC 

*** This bug has been marked as a duplicate of bug 592403 ***
Note You need to log in before you can comment on or make changes to this bug.