Red Hat Bugzilla – Bug 859280
segfault in lookup_hosts.so (lib/rpc_subs.c:381)
Last modified: 2012-12-14 05:28:24 EST
Created attachment 615205 [details]
Patch to fix segfault in lookup_hosts.so
Description of problem:
autofs can crash in lookup_hosts.so due to an uninitialized variable
Version-Release number of selected component (if applicable):
Hard, but the bug is obvious when you look at the code (see attached patch).
Steps to Reproduce:
1. Try to "ls /net/foo" with flaky name servers
2. Hit Ctrl-C while command is hung
3. Check /var/log/messages to see automount segfaulted in lookup_hosts.so
The bug is in lib/rpc_subs.c:create_client(), which can fail to initailize *client.
Specifically, looking at the create_client() function... If the call to rpc_do_create_client() inside the while loop never executes, then *client is never initialized, so the later check (!*client) and the invocation of clnt_control(*client,...) are accessing uninitialized data. This can cause a crash depending on what happens to be on the stack at the time.
(In my case, create_client() itself is called from rpc_portmap_getclient(), which passes a pointer to an uninitialized stack variable as the "client" argument to create_client(). So *client really is uninitialized.)
I have a 24M core dump if you would like to see it. Meanwhile I am attaching a quite trivial and obvious patch to fix the bug.
I believe that the package at:
will resolve your problem, please test it and let me know how
Yes, that does fix it (and some other issues besides). Thank you!
Just out of curiosity, are you folks planning to release an erratum? This is a very nasty failure mode.
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
This issue should have been resolved in another bug in rhel-6.4.
If this is not the case please re-open this bug.