Bug 859280 - segfault in lookup_hosts.so (lib/rpc_subs.c:381)
segfault in lookup_hosts.so (lib/rpc_subs.c:381)
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: autofs (Show other bugs)
All All
unspecified Severity urgent
: rc
: ---
Assigned To: Ian Kent
Red Hat Kernel QE team
Depends On:
  Show dependency treegraph
Reported: 2012-09-20 21:51 EDT by Patrick J. LoPresti
Modified: 2012-12-14 05:28 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-12-14 05:28:24 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Patch to fix segfault in lookup_hosts.so (268 bytes, text/plain)
2012-09-20 21:51 EDT, Patrick J. LoPresti
no flags Details

  None (edit)
Description Patrick J. LoPresti 2012-09-20 21:51:12 EDT
Created attachment 615205 [details]
Patch to fix segfault in lookup_hosts.so

Description of problem:

autofs can crash in lookup_hosts.so due to an uninitialized variable

Version-Release number of selected component (if applicable):

How reproducible:
Hard, but the bug is obvious when you look at the code (see attached patch).

Steps to Reproduce:
1. Try to "ls /net/foo" with flaky name servers
2. Hit Ctrl-C while command is hung
3. Check /var/log/messages to see automount segfaulted in lookup_hosts.so
Actual results:

Expected results:
No segfault

Additional info:
The bug is in lib/rpc_subs.c:create_client(), which can fail to initailize *client.

Specifically, looking at the create_client() function...  If the call to rpc_do_create_client() inside the while loop never executes, then *client is never initialized, so the later check (!*client) and the invocation of clnt_control(*client,...) are accessing uninitialized data.  This can cause a crash depending on what happens to be on the stack at the time.

(In my case, create_client() itself is called from rpc_portmap_getclient(), which passes a pointer to an uninitialized stack variable as the "client" argument to create_client().  So *client really is uninitialized.)

I have a 24M core dump if you would like to see it.  Meanwhile I am attaching a quite trivial and obvious patch to fix the bug.
Comment 2 Ian Kent 2012-09-21 03:34:18 EDT
I believe that the package at:
will resolve your problem, please test it and let me know how
it goes.
Comment 3 Patrick J. LoPresti 2012-09-21 12:55:06 EDT
Yes, that does fix it (and some other issues besides).  Thank you!
Comment 4 Patrick J. LoPresti 2012-11-07 12:45:50 EST
Just out of curiosity, are you folks planning to release an erratum?  This is a very nasty failure mode.
Comment 5 RHEL Product and Program Management 2012-12-14 03:32:41 EST
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Comment 6 Ian Kent 2012-12-14 05:28:24 EST
This issue should have been resolved in another bug in rhel-6.4.
If this is not the case please re-open this bug.

Note You need to log in before you can comment on or make changes to this bug.