bugacl - Bugs: bug #62519, Crash in __acl_to_any_text with...

 
 

bug #62519: Crash in __acl_to_any_text with GCC 12 and -D_FORTIFY_SOURCE=3

Submitter:  Sam James <thesamesam>
Submitted:  Tue 24 May 2022 05:04:26 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 13 Jan 2024 06:50:20 AM UTC, comment #3: 

thanks, i have no recollection of this

Mike Frysinger <vapier>
Group Member
Sat 13 Jan 2024 06:25:34 AM UTC, comment #2: 
Sam James <thesamesam>
Sat 13 Jan 2024 05:43:50 AM UTC, comment #1: 

can you send a patch to the mailing list please ?

Mike Frysinger <vapier>
Group Member
Tue 24 May 2022 05:04:26 PM UTC, original submission:  

I hit this independently in Gentoo (https://bugs.gentoo.org/847280) but the GCC folks hit this (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104964) and concluded it's an ACL bug, not a GCC one.

acl fails when built with GCC 12 (gcc (Gentoo Hardened 12.1.1_p20220521 p5) 12.1.1 20220521 here) and -D_FORTIFY_SOURCE=3. In my case, it crashed systemd-tmpfiles first, as it's linked against libacl:
```
# systemd-tmpfiles --create
/usr/lib/tmpfiles.d/dbus.conf:13: Line references path below legacy directory /var/run/, updating /var/run/dbus/containers → /run/dbus/containers; please update the tmpfiles.d/ drop-in file accordingly.
* buffer overflow detected *: terminated
Aborted (core dumped)
```

For completeness, here's the backtrace:
```
Core was generated by `systemd-tmpfiles --create'.
Program terminated with signal SIGABRT, Aborted.
#0  0x00007f07875674ec in ?? () from /usr/lib64/libc.so.6
gef➤  bt
#0  0x00007f07875674ec in ?? () from /usr/lib64/libc.so.6
#1  0x00007f07875165e2 in raise () from /usr/lib64/libc.so.6
#2  0x00007f078750046c in abort () from /usr/lib64/libc.so.6
#3  0x00007f078755b126 in ?? () from /usr/lib64/libc.so.6
#4  0x00007f07875face2 in __fortify_fail () from /usr/lib64/libc.so.6
#5  0x00007f07875f96c2 in __chk_fail () from /usr/lib64/libc.so.6
#6  0x00007f07875f90e9 in __strncpy_chk () from /usr/lib64/libc.so.6
#7  0x00007f07876dff5e in strncpy (__len=0x4b, __src=0x557d9f5b2860 "adm", __dest=<optimized out>) at /usr/include/bits/string_fortified.h:95
#8  acl_entry_to_any_str (options=0x10, prefix=0x0, mask_d=0x0, size=0x4b, text_p=<optimized out>, entry_d=0x557d9f5b1dc0) at /usr/src/debug/sys-apps/acl-2.3.1/acl-2.3.1/libacl/__acl_to_any_text.c:188
#9  __acl_to_any_text (acl=<optimized out>, len_p=len_p@entry=0x0, prefix=prefix@entry=0x0, separator=separator@entry=0x2c, suffix=suffix@entry=0x0, options=options@entry=0x10) at /usr/src/debug/sys-apps/acl-2.3.1/acl-2.3.1/libacl/__acl_to_any_text.c:66
#10 0x00007f07876df2b3 in acl_to_any_text (acl=<optimized out>, prefix=prefix@entry=0x0, separator=separator@entry=0x2c, options=options@entry=0x10) at /usr/src/debug/sys-apps/acl-2.3.1/acl-2.3.1/libacl/acl_to_any_text.c:33
#11 0x0000557d9f21f79b in path_set_acl (path=path@entry=0x7fff83e33650 "/proc/self/fd/4", pretty=pretty@entry=0x557d9f5b3780 "/var/log/journal", type=type@entry=0x8000, acl=acl@entry=0x557d9f5ae8f8, modify=modify@entry=0x1) at ../systemd-251/src/tmpfiles/tmpfiles.c:1096
#12 0x0000557d9f229a3d in fd_set_acls (item=item@entry=0x557d9f5c3560, fd=fd@entry=0x4, path=path@entry=0x557d9f5b3780 "/var/log/journal", st=0x7fff83e335c0, st@entry=0x0) at ../systemd-251/src/tmpfiles/tmpfiles.c:1143
#13 0x0000557d9f229e2a in path_set_acls (item=0x557d9f5c3560, path=0x557d9f5b3780 "/var/log/journal") at ../systemd-251/src/tmpfiles/tmpfiles.c:1179
#14 0x0000557d9f220786 in glob_item (i=0x557d9f5c3560, action=0x557d9f229df0 <path_set_acls>) at ../systemd-251/src/tmpfiles/tmpfiles.c:1946
#15 0x0000557d9f228088 in create_item (i=<optimized out>) at ../systemd-251/src/tmpfiles/tmpfiles.c:2358
#16 process_item (operation=OPERATION_CREATE, i=0x557d9f5c3560) at ../systemd-251/src/tmpfiles/tmpfiles.c:2575
#17 process_item_array (array=<optimized out>, operation=operation@entry=OPERATION_CREATE) at ../systemd-251/src/tmpfiles/tmpfiles.c:2614
#18 0x0000557d9f21ea39 in run (argv=<optimized out>, argc=<optimized out>) at ../systemd-251/src/tmpfiles/tmpfiles.c:3851
#19 main (argc=<optimized out>, argv=<optimized out>) at ../systemd-251/src/tmpfiles/tmpfiles.c:3866
```

The important quote is from Siddhesh [0]:
"""
OK, closing this as WONTFIX then.  __bos/__bdos has limited support for zero sized arrays; they are not recognized as flex arrays when in nested structs.  Fixing up the struct to one with a proper flex array (i.e. without a dimension size, which also will need another member preceding it) should make this work correctly.  Something like:

struct __string_ext
{
  char pad;
  char s_str[];
};
"""

[0] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104964#c15

Sam James <thesamesam>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by vapier (Posted a comment)
  • -email is unavailable- added by thesamesam (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-01-13 vapier StatusNone Fixed
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-ee12.
    Corresponding source code