[SSSD] [PATCH] DEBUG: Fix crash after fallback from journal log

Lukas Slebodnik lslebodn at redhat.com
Thu Feb 20 16:00:59 UTC 2014


ehlo,

It was not easy to reproduce this crash in the find-uid-test (log attached)

Here is a backtrace:
#0  0x00007fbeaf7850cf in _IO_vfprintf_internal (s=<optimized out>, format=<optimized out>, ap=<optimized out>) at vfprintf.c:1635
#1  0x00007fbeaf788b01 in buffered_vfprintf (s=s at entry=0x7fbeafaf51c0 <_IO_2_1_stderr_>, format=format at entry=0x7fbeb119c1a8 "Proc file [%s] is not available anymore, continuing.\n", args=args at entry=0x7fff2d20b668) at vfprintf.c:2328
#2  0x00007fbeaf783ffe in _IO_vfprintf_internal (s=s at entry=0x7fbeafaf51c0 <_IO_2_1_stderr_>, format=0x7fbeb119c1a8 "Proc file [%s] is not available anymore, continuing.\n", ap=0x7fff2d20b668) at vfprintf.c:1289
#3  0x00007fbeaf840a06 in ___vfprintf_chk (fp=0x7fbeafaf51c0 <_IO_2_1_stderr_>, flag=1, format=<optimized out>, ap=<optimized out>) at vfprintf_chk.c:33
#4  0x00007fbeb0d7461a in debug_fn (file=file at entry=0x7fbeb119bfcf "src/util/find_uid.c", line=line at entry=90, function=function at entry=0x7fbeb119c270 <__FUNCTION__.8600> "get_uid_from_pid", level=level at entry=4096, format=format at entry=0x7fbeb119c1a8 "Proc file [%s] is not available anymore, continuing.\n") at src/util/debug.c:257
#5  0x00007fbeb119ae74 in get_uid_from_pid (pid=<optimized out>, uid=uid at entry=0x7fff2d20c9a4) at src/util/find_uid.c:88
#6  0x00007fbeb119b381 in get_active_uid_linux (table=table at entry=0x0, search_uid=search_uid at entry=4294967292) at src/util/find_uid.c:236
#7  0x00007fbeb119b69f in check_if_uid_is_active (uid=uid at entry=4294967292, result=result at entry=0x7fff2d20ca67) at src/util/find_uid.c:333
#8  0x00007fbeb119a9ab in test_check_if_uid_is_active_fail (_i=<optimized out>) at src/tests/find_uid-tests.c:58
#9  0x00007fbeb054887e in tcase_run_tfun_fork (i=0, tfun=0x7fbeb14a0300, tc=0x7fbeb14a00a0, sr=0x7fbeb14a0390) at check_run.c:396
#10 srunner_iterate_tcase_tfuns (tc=0x7fbeb14a00a0, sr=0x7fbeb14a0390) at check_run.c:181
#11 srunner_run_tcase (tc=0x7fbeb14a00a0, sr=0x7fbeb14a0390) at check_run.c:313
#12 srunner_iterate_suites (print_mode=CK_SILENT, tcname=0x0, sname=0x0, sr=0x7fbeb14a0390) at check_run.c:156
#13 srunner_run (sr=sr at entry=0x7fbeb14a0390, sname=sname at entry=0x0, tcname=tcname at entry=0x0, print_mode=print_mode at entry=CK_ENV) at check_run.c:618
#14 0x00007fbeb054892b in srunner_run_all (sr=sr at entry=0x7fbeb14a0390, print_mode=print_mode at entry=CK_ENV) at check_run.c:587
#15 0x00007fbeb119a685 in main () at src/tests/find_uid-tests.c:125


(gdb) l src/util/find_uid.c:88
83
84          fd = open(path, O_RDONLY);
85          if (fd == -1) {
86              error = errno;
87              if (error == ENOENT) {
88                  DEBUG(SSSDBG_TRACE_LIBS,
89                        "Proc file [%s] is not available anymore, continuing.\n",
90                            path);
91                  return EOK;
92              }

As you can see in frame 5, it was caused by DEBUG macro. It was strange
because variable path was declared on stack "char path[PATHLEN];"

But it looks like va_list should not be used twice.
http://en.cppreference.com/w/cpp/utility/variadic/va_copy

It is really difficult to reproduce it.
I was not able to reproduce problem on fedora 19 or rawhide
http://koji.fedoraproject.org/koji/taskinfo?taskID=6551367
http://koji.fedoraproject.org/koji/taskinfo?taskID=6551377

and only sometimes on fedora 20 x86_64
http://koji.fedoraproject.org/koji/taskinfo?taskID=6551997 --works
http://koji.fedoraproject.org/koji/taskinfo?taskID=6551349 --doesn't work

Patch is attached.

LS
-------------- next part --------------
Running suite(s): find_uid
Proc file [  1268 kB
VmData:	     448 kB
VmStk:	     136 kB
VmExe:	      16 kB
VmLib:	    5168 kB
VmPTE:	     108 kB
VmSwap:	       0 kB
Threads:	1
SigQ:	2/61566
SigPnd:	0000000000000000
ShdPnd:	0000000000000000
SigBlk:	0000000000000000
SigIgn:	0000000001000000
SigCgt:	0000000180002000
CapInh:	0000000000000000
CapPrm:	0000000000000000
CapEff:	0000000000000000
CapBnd:	0000001fffffffff
Seccomp:	0
Cpus_allowed:	ff
Cpus_allowed_list:	0-7
Mems_allowed:	00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001
Mems_allowed_list:	0
voluntary_ctxt_switches:	21
nonvoluntary_ctxt_switches:	2
70
s:	2



] is not available anymore, continuing.
66%: Checks: 3, Failures: 0, Errors: 1
src/tests/find_uid-tests.c:50:E:find_uid:test_check_if_uid_is_active_fail:0: (after this point) Received signal 11 (Segmentation fault)
-------------- next part --------------
>From a05c53c12ae81c59eca39bc66b2808cb86d0641b Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Thu, 20 Feb 2014 13:11:27 +0100
Subject: [PATCH] DEBUG: Fix crash after fallback from journal log

if journal_send fail we should not use the same va_list in the fallback
functions. va_list can be modiefied and it may cause crashes im some
cases e.g. printing string.

This patch use copy of initialised va_list for debug_vprintf function.
---
 src/util/debug.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/util/debug.c b/src/util/debug.c
index 9cd0f41fffcda50bec52147b4bc9afe836392a17..1db3693a11bef9d6dced6b085e320d99c4fe3384 100644
--- a/src/util/debug.c
+++ b/src/util/debug.c
@@ -203,6 +203,7 @@ void debug_fn(const char *file,
               const char *format, ...)
 {
     va_list ap;
+    va_list ap_fallback;
     struct timeval tv;
     struct tm *tm;
     char datetime[20];
@@ -220,13 +221,15 @@ void debug_fn(const char *file,
          * searchable.
          */
         va_start(ap, format);
+        va_copy(ap_fallback, ap);
         ret = journal_send(file, line, function, level, format, ap);
+        va_end(ap);
         if (ret != EOK) {
             /* Emergency fallback, send to STDERR */
-            debug_vprintf(format, ap);
+            debug_vprintf(format, ap_fallback);
             debug_fflush();
         }
-        va_end(ap);
+        va_end(ap_fallback);
         return;
     }
 #endif
-- 
1.8.5.3



More information about the sssd-devel mailing list