Race condition when custom .ctors entries call ip2unix symbols #29
Comments
|
I recompiled without systemd support and ran the ran the same test that was run with systemd support. It still crashes with a FP exception. It occurs in an unsorted set used in the socket.cc code. |
|
Just tried to write a small regression test but couldn't reproduce this error. Regression test# Regression test for https://github.com/nixcloud/ip2unix/issues/29
{ pkgs, ip2unix, ... }:
pkgs.runCommand "test-custom-ctor" {
nativeBuildInputs = [
ip2unix pkgs.netcat-openbsd pkgs.systemd
(pkgs.writeCBin "testprog" ''
#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <netinet/ip.h>
void __attribute__ ((constructor)) foobar(void) {
close(3);
fputs("testprog: Closed file descriptor 3.\n", stderr);
}
int main(void) {
int fd, conn;
char buf[7];
struct sockaddr_in sa;
if ((fd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket");
return EXIT_FAILURE;
}
sa.sin_family = AF_INET;
sa.sin_addr.s_addr = htonl(INADDR_ANY);
sa.sin_port = htons(666);
if (bind(fd, (struct sockaddr *)&sa, sizeof sa) == -1) {
close(fd);
perror("bind");
return EXIT_FAILURE;
}
if (listen(fd, 10) == -1) {
close(fd);
perror("listen");
return EXIT_FAILURE;
}
if ((conn = accept(fd, NULL, 0)) == -1) {
close(fd);
perror("accept");
return EXIT_FAILURE;
}
if (recv(conn, buf, sizeof(buf) - 1, MSG_WAITALL) == -1) {
close(conn);
close(fd);
perror("recv");
return EXIT_FAILURE;
}
buf[sizeof(buf) - 1] == '\0';
close(conn);
close(fd);
if (strncmp(buf, "foobar", sizeof(buf)) != 0) {
fprintf(stderr, "Message \"%s\" didn't match \"foobar\".\n", buf);
return EXIT_FAILURE;
}
fputs("Got \"foobar\" from socket.\n", stderr);
return EXIT_SUCCESS;
}
'')
];
} ''
systemd-socket-activate -l "$PWD/test.socket" \
ip2unix -vvvvv -r systemd testprog &
while [ ! -e test.socket ]; do sleep 1; done
echo -n foobar | nc -U test.socket
wait -n
touch "$out"
''Output: @tiboratAS: Is the program you're using publicly available, so I can directly use the program you're using as a regression test? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This was reported via email and it happens whenever an application places entries via eg.
__attribute__((constructor))into the.ctorssection. If the constructor then calls functions that we wrap, we might end up accessing uninitialised memory because at that time static data on our side might not be initialised.The reporter also included a traceback:
So we should be able to trivially reproduce it with something like this:
The text was updated successfully, but these errors were encountered: