* [LTP] [PATCH v3] Fix use after stack unwind in fzsync lib
@ 2020-03-26 15:28 Martin Doucha
2020-03-26 15:43 ` Cyril Hrubis
2020-03-26 20:41 ` Petr Vorel
0 siblings, 2 replies; 4+ messages in thread
From: Martin Doucha @ 2020-03-26 15:28 UTC (permalink / raw)
To: ltp
tst_fzsync_pair_reset() passes a local variable to thread B which may be
already unwinded by the time the thread wrapper function executes. If new
variables get allocated and initialized on stack between pthread_create()
and thread wrapper execution, thread B will segfault.
Signed-off-by: Martin Doucha <mdoucha@suse.cz>
---
Changes since v1:
- Use tst_alloc() instead of SAFE_MALLOC() to prevent memory leak even if
SAFE_PTHREAD_CREATE() fails
- Revert changes in tst_fzsync_thread_wrapper() as they're no longer needed
Changes since v2:
- Use static local variable instead to prevent memory leaks
include/tst_fuzzy_sync.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/include/tst_fuzzy_sync.h b/include/tst_fuzzy_sync.h
index c1d0b00f9..9ff3a78ae 100644
--- a/include/tst_fuzzy_sync.h
+++ b/include/tst_fuzzy_sync.h
@@ -297,7 +297,10 @@ static void tst_fzsync_pair_reset(struct tst_fzsync_pair *pair,
pair->b_cntr = 0;
pair->exit = 0;
if (run_b) {
- struct tst_fzsync_run_thread wrap_run_b = {.func = run_b, .arg = NULL};
+ static struct tst_fzsync_run_thread wrap_run_b;
+
+ wrap_run_b.func = run_b;
+ wrap_run_b.arg = NULL;
SAFE_PTHREAD_CREATE(&pair->thread_b, 0, tst_fzsync_thread_wrapper, &wrap_run_b);
}
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [LTP] [PATCH v3] Fix use after stack unwind in fzsync lib
2020-03-26 15:28 [LTP] [PATCH v3] Fix use after stack unwind in fzsync lib Martin Doucha
@ 2020-03-26 15:43 ` Cyril Hrubis
2020-03-26 20:41 ` Petr Vorel
1 sibling, 0 replies; 4+ messages in thread
From: Cyril Hrubis @ 2020-03-26 15:43 UTC (permalink / raw)
To: ltp
Hi!
Pushed, thanks.
--
Cyril Hrubis
chrubis@suse.cz
^ permalink raw reply [flat|nested] 4+ messages in thread
* [LTP] [PATCH v3] Fix use after stack unwind in fzsync lib
2020-03-26 15:28 [LTP] [PATCH v3] Fix use after stack unwind in fzsync lib Martin Doucha
2020-03-26 15:43 ` Cyril Hrubis
@ 2020-03-26 20:41 ` Petr Vorel
2020-03-27 8:42 ` Martin Doucha
1 sibling, 1 reply; 4+ messages in thread
From: Petr Vorel @ 2020-03-26 20:41 UTC (permalink / raw)
To: ltp
Hi Martin,
> tst_fzsync_pair_reset() passes a local variable to thread B which may be
> already unwinded by the time the thread wrapper function executes. If new
> variables get allocated and initialized on stack between pthread_create()
> and thread wrapper execution, thread B will segfault.
I naively assumed this would fix SIGKILL signal for CVE 2018-1000199 test,
but it didn't.
Kind regards,
Petr
^ permalink raw reply [flat|nested] 4+ messages in thread
* [LTP] [PATCH v3] Fix use after stack unwind in fzsync lib
2020-03-26 20:41 ` Petr Vorel
@ 2020-03-27 8:42 ` Martin Doucha
0 siblings, 0 replies; 4+ messages in thread
From: Martin Doucha @ 2020-03-27 8:42 UTC (permalink / raw)
To: ltp
On 26. 03. 20 21:41, Petr Vorel wrote:
> Hi Martin,
>
>> tst_fzsync_pair_reset() passes a local variable to thread B which may be
>> already unwinded by the time the thread wrapper function executes. If new
>> variables get allocated and initialized on stack between pthread_create()
>> and thread wrapper execution, thread B will segfault.
>
> I naively assumed this would fix SIGKILL signal for CVE 2018-1000199 test,
> but it didn't.
No, the fuzzysync fix is unrelated to the CVE-2018-1000199 test. I ran
into mysterious segfaults while writing a test for CVE-2018-18559 which
I haven't finished yet.
--
Martin Doucha mdoucha@suse.cz
QA Engineer for Software Maintenance
SUSE LINUX, s.r.o.
CORSO IIa
Krizikova 148/34
186 00 Prague 8
Czech Republic
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-03-27 8:42 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-26 15:28 [LTP] [PATCH v3] Fix use after stack unwind in fzsync lib Martin Doucha
2020-03-26 15:43 ` Cyril Hrubis
2020-03-26 20:41 ` Petr Vorel
2020-03-27 8:42 ` Martin Doucha
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.