zvol_id failing on gentoo (probably other distributions who build with stack protection) #569

Peitolm · 2012-02-12T21:40:20Z

/lib/udev/zvol_id /dev/zd0

*** stack smashing detected ***: zvol_id - terminated
zvol_id: stack smashing attack in function - terminated
Report to http://bugs.gentoo.org/
Killed

added -fno-stack-protector to the compile line for zvol_id and it compiles and works,

/lib/udev/zvol_id /dev/zd0

tank/volume

ryao · 2012-02-12T22:04:29Z

Would you post your "emerge --info"?

Peitolm · 2012-02-13T09:56:00Z

Portage 2.1.10.10 (hardened/linux/x86, gcc-4.4.4-hardenednopie, glibc-2.11.2-r3, 3.2.1-gentoo-r2 i686)
=================================================================
System uname: Linux-3.2.1-gentoo-r2-i686-AMD_Athlon-tm-_II_X2_245e_Processor-with-gentoo-2.0.3
Timestamp of tree: Tue, 31 Jan 2012 20:05:01 +0000
app-shells/bash:          4.1_p7
dev-java/java-config:     1.3.7::<unknown repository>, 2.1.11
dev-lang/python:          2.4.3-r4::<unknown repository>, 2.5.4-r4, 2.6.6-r1, 3.1.2-r4
dev-util/cmake:           2.8.1-r2
dev-util/pkgconfig:       0.25-r2
sys-apps/baselayout:      2.0.3
sys-apps/openrc:          0.9.8.4
sys-apps/sandbox:         2.3-r1
sys-devel/autoconf:       2.13, 2.65-r1
sys-devel/automake:       1.4_p6::<unknown repository>, 1.5::<unknown repository>, 1.6.3::<unknown repository>, 1.7.9-1::<unknown repository>, 1.8.5-r3::<unknown repository>, 1.9.6-r3, 1.10.3, 1.11.1
sys-devel/binutils:       2.20.1-r1
sys-devel/gcc:            4.4.4-r2
sys-devel/gcc-config:     1.4.1
sys-devel/libtool:        2.2.10
sys-devel/make:           3.81-r2
sys-kernel/linux-headers: 2.6.30-r1 (virtual/os-headers)
sys-libs/glibc:           2.11.2-r3
Repositories: gentoo mythtv x-forked-daapd
ACCEPT_KEYWORDS="x86"
ACCEPT_LICENSE="* -@EULA"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-march=k8 -O2 -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/X11/xkb"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-march=k8 -O2 -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="assume-digests binpkg-logs buildpkg distlocks ebuild-locks fixlafiles fixpackages news parallel-fetch protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch"
FFLAGS=""
GENTOO_MIRRORS="http://distfiles.gentoo.org"
LC_ALL="en_GB"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/mythtv_portage/Gentoo /usr/local/forked-daapd"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X acl alsa apache2 apm berkdb bzip2 cairo cli cracklib crypt cups cxx dbus dri dts dvb dvd gd gdbm gpm gtk hardened iconv lm_sensors mmx modules mudflap mysql ncurses nls nptl nptlonly opengl openmp pam pax_kernel pcre pic pmu posix pppd qt3support readline session ssl sysfs tcpd urandom x86 xattr xorg xulrunner zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1 emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="access auth auth_dbm auth_anon auth_digest alias file-cache echo charset-lite cache disk-cache mem-cache ext-filter case_filter case-filter-in deflate mime-magic cern-meta expires headers usertrack unique-id proxy proxy-connect proxy-ftp proxy-http info include cgi cgid dav dav-fs vhost-alias speling rewrite log_config logio env setenvif mime status autoindex asis negotiation dir imap actions userdir so filter auth_basic authn_alias authn_anon authn_dbd authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user dav_fs dav_lock dbd log_forensic mem_cache unique_id version vhost_alias" CALLIGRA_FEATURES="kexi words flow plan stage tables krita karbon braindump" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" PHP_TARGETS="php5-3" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="apm ark chips cirrus cyrix dummy fbdev glint i128 i740 intel mach64 mga neomagic nsc nv r128 radeon rendition s3 s3virge savage siliconmotion sis sisusb tdfx tga trident tseng v4l vesa via vmware nouveau" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LINGUAS, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

behlendorf · 2012-02-14T00:45:54Z

@Peitolm Can you try the following patch, behlendorf/zfs@74468a3 . It does a little restructuring/clean up to the zvol_id helper, in particular it removes one possible buffer overflow which could explain this issue.

Peitolm · 2012-02-19T20:21:26Z

Sadly still having some problems,

/usr/lib/udev/zvol_id /dev/zd0
Unable to get zvol name for /dev/zd0: 25
*** glibc detected *** /usr/lib/udev/zvol_id: free(): invalid pointer: 0x08048950 ***
======= Backtrace: =========
/lib/libc.so.6(+0x6b881)[0xb75d6881]
/lib/libc.so.6(+0x6d0e8)[0xb75d80e8]
/lib/libc.so.6(cfree+0x6d)[0xb75db1cd]
/usr/lib/udev/zvol_id[0x804887d]
/lib/libc.so.6(__libc_start_main+0xe6)[0xb7581bd6]
/usr/lib/udev/zvol_id[0x8048651]
======= Memory map: ========
08048000-08049000 r-xp 00000000 fd:00 1035718    /usr/lib/udev/zvol_id
08049000-0804a000 r--p 00000000 fd:00 1035718    /usr/lib/udev/zvol_id
0804a000-0804b000 rw-p 00001000 fd:00 1035718    /usr/lib/udev/zvol_id
0804b000-0806c000 rw-p 00000000 00:00 0          [heap]
b754d000-b7567000 r-xp 00000000 fd:00 1034838    /usr/lib/gcc/i686-pc-linux-gnu/4.4.4/libgcc_s.so.1
b7567000-b7568000 r--p 0001a000 fd:00 1034838    /usr/lib/gcc/i686-pc-linux-gnu/4.4.4/libgcc_s.so.1
b7568000-b7569000 rw-p 0001b000 fd:00 1034838    /usr/lib/gcc/i686-pc-linux-gnu/4.4.4/libgcc_s.so.1
b7569000-b756b000 rw-p 00000000 00:00 0 
b756b000-b76ac000 r-xp 00000000 fd:02 6653238    /lib/libc-2.11.2.so
b76ac000-b76ae000 r--p 00141000 fd:02 6653238    /lib/libc-2.11.2.so
b76ae000-b76af000 rw-p 00143000 fd:02 6653238    /lib/libc-2.11.2.so
b76af000-b76b2000 rw-p 00000000 00:00 0 
b76b2000-b76c6000 r-xp 00000000 fd:02 6651962    /lib/libz.so.1.2.5
b76c6000-b76c7000 r--p 00013000 fd:02 6651962    /lib/libz.so.1.2.5
b76c7000-b76c8000 rw-p 00014000 fd:02 6651962    /lib/libz.so.1.2.5
b76c8000-b76cb000 r-xp 00000000 fd:02 6652244    /lib/libuuid.so.1.3.0
b76cb000-b76cc000 r--p 00002000 fd:02 6652244    /lib/libuuid.so.1.3.0
b76cc000-b76cd000 rw-p 00003000 fd:02 6652244    /lib/libuuid.so.1.3.0
b76e3000-b76e4000 rw-p 00000000 00:00 0 
b76e4000-b7700000 r-xp 00000000 fd:02 6653263    /lib/ld-2.11.2.so
b7700000-b7701000 r--p 0001b000 fd:02 6653263    /lib/ld-2.11.2.so
b7701000-b7702000 rw-p 0001c000 fd:02 6653263    /lib/ld-2.11.2.so
bfe0b000-bfe2c000 rw-p 00000000 00:00 0          [stack]
ffffe000-fffff000 r-xp 00000000 00:00 0          [vdso]
Aborted

behlendorf · 2012-02-21T17:05:11Z

No problem, I'll try to find a little time to run the helper under Valgrind and make sure everything works properly.

rosscameron · 2012-06-06T14:30:53Z

Posted a pull request (#775) that corrects this on RHEL/CentOS and I'm assuming other distro's using stack protection.

Its a kludge but it works in my environments (so far) will also try make some time to Valgrind the code but can't make any promises on that one.

This is not a proper fix. It is just a workaround for the stack smashing detected by gcc in zvol_id. We simply disable the gcc stack protector for now when building the zvol_id udev helper. Once the root cause is resolved this patch should be reverted. Signed-off-by: Brian Behlendorf <[email protected]> Issues openzfs#569

The previous implementation of zvol_id suffered from a possible buffer overflow. When appending the '-part' partition informtation it was possible to overrun the provided buffer. This issue was resolved by dynamically allocating a buffer of the correct length using asprintf(). Additionally, since this was such a straight forward little program I took the opportunity to restructure the code. Signed-off-by: Brian Behlendorf <[email protected]> Issue openzfs#569

+ crashes on 64bit kernel with 32bit userland.

ryao · 2015-09-09T21:17:37Z

@behlendorf #775 did fix this.

behlendorf · 2015-09-09T21:25:28Z

@ryao thanks. It looks like there is still some room for improvement here but the basic issue has been resolved. Closing.

Remove the code that doesn't make any sense. Reviewed-by: Brian Behlendorf <[email protected]> Signed-off-by: Chunwei Chen <[email protected]> Closes openzfs#569

openzfs#569 was opened in 2012 and closed in 2015; if the issue was still there we'd presumably've seen it? Signed-off-by: Ahelenia Ziemiańska <[email protected]>

#569 was opened in 2012 and closed in 2015; if the issue was still there we'd presumably've seen it? Reviewed-by: Brian Behlendorf <[email protected]> Signed-off-by: Ahelenia Ziemiańska <[email protected]> Closes #13316

openzfs#569 was opened in 2012 and closed in 2015; if the issue was still there we'd presumably've seen it? Reviewed-by: Brian Behlendorf <[email protected]> Signed-off-by: Ahelenia Ziemiańska <[email protected]> Closes openzfs#13316

behlendorf mentioned this issue Apr 2, 2012

Iscsi+smbfs #621

Closed

behlendorf referenced this issue in FransUrbo/zfs Apr 23, 2013

Remove '-g -O2' when building zvol_id.

617c2cd

+ crashes on 64bit kernel with 32bit userland.

behlendorf added Bug - Minor and removed Bug labels Oct 6, 2014

behlendorf removed this from the 0.6.7 milestone Nov 8, 2014

behlendorf closed this as completed Sep 9, 2015

behlendorf pushed a commit to behlendorf/zfs that referenced this issue May 21, 2018

Cleanup in cred.h

4329bd5

Remove the code that doesn't make any sense. Reviewed-by: Brian Behlendorf <[email protected]> Signed-off-by: Chunwei Chen <[email protected]> Closes openzfs#569

pcd1193182 pushed a commit to pcd1193182/zfs that referenced this issue Sep 26, 2023

fix error context message in chunk_from_raw_impl() (openzfs#569)

5020a41

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

zvol_id failing on gentoo (probably other distributions who build with stack protection) #569

zvol_id failing on gentoo (probably other distributions who build with stack protection) #569

Peitolm commented Feb 12, 2012

ryao commented Feb 12, 2012

Peitolm commented Feb 13, 2012

behlendorf commented Feb 14, 2012

Peitolm commented Feb 19, 2012

behlendorf commented Feb 21, 2012

rosscameron commented Jun 6, 2012

ryao commented Sep 9, 2015

behlendorf commented Sep 9, 2015

zvol_id failing on gentoo (probably other distributions who build with stack protection) #569

zvol_id failing on gentoo (probably other distributions who build with stack protection) #569

Comments

Peitolm commented Feb 12, 2012

/lib/udev/zvol_id /dev/zd0

/lib/udev/zvol_id /dev/zd0

ryao commented Feb 12, 2012

Peitolm commented Feb 13, 2012

behlendorf commented Feb 14, 2012

Peitolm commented Feb 19, 2012

behlendorf commented Feb 21, 2012

rosscameron commented Jun 6, 2012

ryao commented Sep 9, 2015

behlendorf commented Sep 9, 2015