Your message dated Thu, 21 Apr 2016 16:52:25 +0000 with message-id <[email protected]> and subject line Bug#819287: fixed in ifupdown 0.8.11 has caused the Debian Bug report #819287, regarding [ifupdown] ifquery crashes with segfault during boot on Ubuntu 15.10 to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 819287: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819287 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: ifupdown Version: 0.7.54ubuntu1.3 The following crash is easily reproducible on Ubuntu/15.10: "[ 2.091111] ifquery[617]: segfault at 0 ip 00007f84bb722327 sp 00007ffde43a0488 error 4 in libc-2.21.so[7f84bb5dd000+1c0000]" Checking the corresponding core dump shows the problem: $ gdb --core /var/crash/ifquery-617-11.core /sbin/ifquery ... Core was generated by `ifquery --state eno1'. Program terminated with signal SIGSEGV, Segmentation fault. #0 __strncmp_sse42 () at ../sysdeps/x86_64/multiarch/strcmp-sse42.S:235 235 ../sysdeps/x86_64/multiarch/strcmp-sse42.S: No such file or directory. (gdb) bt #0 __strncmp_sse42 () at ../sysdeps/x86_64/multiarch/strcmp-sse42.S:235 #1 0x0000000000403381 in main (argc=<optimized out>, argv=<optimized out>) at main.c:630 (gdb) l 230 in ../sysdeps/x86_64/multiarch/strcmp-sse42.S (gdb) f 1 #1 0x0000000000403381 in main (argc=<optimized out>, argv=<optimized out>) at main.c:630 warning: Source file is more recent than executable. 630 if (strncmp(target_iface[j], up_ifaces[i], l) == 0) { (gdb) l 625 for (int j = 0; j < n_target_ifaces; j++) { 626 size_t l = strlen(target_iface[j]); 627 bool found = false; 628 629 for (int i = 0; i < n_up_ifaces; i++) { 630 if (strncmp(target_iface[j], up_ifaces[i], l) == 0) { 631 if (up_ifaces[i][l] == '=') { 632 puts(up_ifaces[i]); 633 found = true; 634 break; (gdb) p n_target_ifaces $1 = 1 (gdb) p j $2 = 0 (gdb) p target_iface[j] $3 = 0x7ffde43a1f7a "eno1" (gdb) p n_up_ifaces $4 = 4 (gdb) p i $5 = 0 (gdb) p up_ifaces[i] $6 = 0x0 (gdb) p l $7 = 4 So read_all_state() leaves uninitialized values in up_ifaces and n_up_ifaces if the interface state file doesn't exist which leads to strnmp segfaulting due to the invalid pointer passed to it. On my Ubuntu 15.10 system the state file doesn't exist yet when ifquery runs and so I hit this problem easily. There doesn't seem to be any further issues related to this though, the state file gets created eventually and the network comes up fine. I attached a patch that fixes this and gets rid of the boot time segfault. --Imre>From 1fcf1cd2bf0a92ff87ad7a44b3c7dbb532be5669 Mon Sep 17 00:00:00 2001 From: Imre Deak <[email protected]> Date: Sat, 26 Mar 2016 03:20:38 +0200 Subject: [PATCH] Fix read_all_state when no statefile exists When no statefile exists read_all_state() may return with the interface array and number of array entries being uninitialized. In case the number of array entries happens to be non-zero the caller will access an invalid pointer. This resulted in ifquery segfaulting during booting on Ubuntu 15.10 while running ifquery at a time when the /var/run/network/ifstate file didn't exist yet. Fix this by making sure read_all_state() always initializes its return values. Signed-off-by: Imre Deak <[email protected]> --- debian/changelog | 6 ++++++ main.c | 6 +++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/debian/changelog b/debian/changelog index a03d062..b30acf0 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +ifupdown (0.7.54ubuntu1.3ideak1) UNRELEASED; urgency=medium + + * Fix read_all_state when no state file exists + + -- Imre Deak <[email protected]> Sat, 26 Mar 2016 03:21:19 +0200 + ifupdown (0.7.54ubuntu1.3) wily; urgency=medium * Fix false-positive recursion detection. (LP: #1545302) diff --git a/main.c b/main.c index 76a7ad8..8f2dbcc 100644 --- a/main.c +++ b/main.c @@ -272,6 +272,9 @@ static void read_all_state(const char *argv0, char ***ifaces, int *n_ifaces) { FILE *lock_fp = lock_state(argv0); FILE *state_fp = fopen(statefile, no_act ? "r" : "a+"); + *n_ifaces = 0; + *ifaces = NULL; + if (state_fp == NULL) { if (!no_act) { fprintf(stderr, "%s: failed to open statefile %s: %s\n", argv0, statefile, strerror(errno)); @@ -290,9 +293,6 @@ static void read_all_state(const char *argv0, char ***ifaces, int *n_ifaces) { } } - *n_ifaces = 0; - *ifaces = NULL; - char buf[80]; char *p; -- 2.5.0
--- End Message ---
--- Begin Message ---Source: ifupdown Source-Version: 0.8.11 We believe that the bug you reported is fixed in the latest version of ifupdown, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Guus Sliepen <[email protected]> (supplier of updated ifupdown package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Thu, 21 Apr 2016 18:22:20 +0200 Source: ifupdown Binary: ifupdown Architecture: source amd64 Version: 0.8.11 Distribution: unstable Urgency: medium Maintainer: Guus Sliepen <[email protected]> Changed-By: Guus Sliepen <[email protected]> Description: ifupdown - high level tools to configure network interfaces Closes: 814312 819287 Changes: ifupdown (0.8.11) unstable; urgency=medium . [ Wido den Hollander ] * Wait properly for Link-Local Address to go through DAD. . [ Imre Deak ] * Fix read_all_state when no state file exists. Closes: 819287 . [ Arthur Gautier ] * Implement link naming (ip link set alias) . [ Martin Pitt <[email protected]> ] * Add autopkgtest for "allow-hotplug" interfaces. Closes: #814312 . [ Guus Sliepen ] * Bump Standards-Version. Checksums-Sha1: fa2cd04f10e44baba9dafaac7fd49df84ee6ce7e 1563 ifupdown_0.8.11.dsc 39781555409162abc11727080540343f688473f2 70660 ifupdown_0.8.11.tar.xz b6afa991f80bdad8a0e66f4aa59cbbf4e5afbb0a 62030 ifupdown-dbgsym_0.8.11_amd64.deb d1e4435b9e626f868f56f6b2faac0388b561bc74 74146 ifupdown_0.8.11_amd64.deb Checksums-Sha256: 59866431e582f03bc4e084cda5a71938bf75ddd62a1548c22fa5f7c3d734fdc8 1563 ifupdown_0.8.11.dsc 031bde2faec65e1c962476eba19718f0918ca7e058882cd06e032e4f95e88e87 70660 ifupdown_0.8.11.tar.xz 517d61d112d4a847642fb2a4a1a69c36832198f7a3fbf4c84a8114512021f4ef 62030 ifupdown-dbgsym_0.8.11_amd64.deb e89368b40d96d86c24a64aad0ee13a4f684817d6c2d087bc50fabf25096e0724 74146 ifupdown_0.8.11_amd64.deb Files: b861f42bbeec9c5c374b456ed024b363 1563 admin important ifupdown_0.8.11.dsc a21aa737a374c58ccde119bb9f9beac8 70660 admin important ifupdown_0.8.11.tar.xz 29d972339fedb51d1b3ed359b6b29a94 62030 debug extra ifupdown-dbgsym_0.8.11_amd64.deb df9c61b760af2edb61629c85c6daee37 74146 admin important ifupdown_0.8.11_amd64.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJXGP7BAAoJED9JDeuHHvn6FJEP/R6o5dwRzoacA2HI87dE28j5 eTS9YctbtUnKTrSmZGTo7N9CtAgAAY8zKWNTVzRq69Ll45CyLyxqUUKsTXRlnsO5 G3HgW132yEu6qPj6b5jnyscJRoU/1KW49Z79q3r+lDuxsiQ6RqK3IaTqe/5/sMf2 zMYFhTLg+OtGjMwrPZ/E9iFI6uaTOhCE/Wzhd+eskyi1uJMgwI6YkgS3HG2ukqJV bhp74Y4w2BvzsdBjE4/0Ke9Xbd66dcQOi/+CXADsqNMXAKND+HvSPL9rjZOB/5ur Ueo8FAUxYZVVh/XKXjzRXKQ5MbTDLcPpbmZ/fixdcwRW30bk3ofJAVxKOCJjnnb/ YUtmlHa2ETdzzI3lbiec4X9xDnnabtbQt3F91IUb5mAsa0QfjDseiWfK598ZDjnn ACvTTwlMNFbBFUf+pG/3AmCHRlmWFlB6NDKK3Cz/9X9Nus5IEnnMw7fV9DbWu9IM VaTxnrO12KPBlgTwI4PfG1VWhDodjGPpBlmv5VE7BwxIG3nNapkoCpPKRPVfGbuF dN4Q+UdDVfpIIcR8Ebtapq9SW/XIjOhDHfRlZ3SJUCWKAyRtRMjJ/DMMDU29FMGJ OxAKmzBtbCZNK97qS4mqARRnJholYTQi8b3VJx65DUu/RliTHYicjWR9CmcBMSsP 2Jvo68jm+b/kYW34/U0m =G72G -----END PGP SIGNATURE-----
--- End Message ---
