[Bug 1059592] Re: Message and memory corruption in rsyslog

[Adam Conrad]

Hello Stuart, or anyone else affected,

Accepted rsyslog into quantal-proposed. The package will build now and
be available at
http://launchpad.net/ubuntu/+source/rsyslog/5.8.6-1ubuntu9.1 in a few
hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to
enable and use -proposed.  Your feedback will aid us getting this update
out to other Ubuntu users.

If this package fixes the bug for you, please change the bug tag from
verification-needed to verification-done.  If it does not, change the
tag to verification-failed.  In either case, details of your testing
will help us make a better decision.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance!

** Changed in: rsyslog (Ubuntu Quantal)
       Status: In Progress => Fix Committed

** Tags added: verification-needed

** Changed in: rsyslog (Ubuntu Precise)
       Status: In Progress => Fix Committed

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rsyslog in Ubuntu.
https://bugs.launchpad.net/bugs/1059592

Title:
  Message and memory corruption in rsyslog

Status in “rsyslog” package in Ubuntu:
  Fix Released
Status in “rsyslog” source package in Precise:
  Fix Committed
Status in “rsyslog” source package in Quantal:
  Fix Committed
Status in “rsyslog” source package in Raring:
  Fix Released
Status in “rsyslog” package in Debian:
  Fix Released

Bug description:
  When using the RFC5424 format, I've seen a number of corruptions in
  the messages (missing messages and unprintable characters). I've also
  had rsyslog crash out with "*** glibc detected *** rsyslogd: corrupted
  double-linked list: ... ***".  The message corruptions match this
  upstream bug - http://bugzilla.adiscon.com/show_bug.cgi?id=296

  Based on the bug fixes to rsyslog between 5.8.6 and 5.10.0, it appears
  that there have been various race conditions and memory corruption
  issues that have since been fixed (5.8.6 is now nearly a year old).

  In addition, rsyslog has some errors in the RFC5424 format that would
  also be fixed by an update to 5.10.0 (like the nil value for PID and
  the hostname in "last message repeated X times")

  System information:
  Ubuntu 12.04 LTS
  rsyslog 5.8.6-1ubuntu8

  --

  Quantal/Precise SRU Justification

  [Impact]
   * If rsyslogd is configured using the RFC5424 format, messages can become corrupted and rsyslogd can potentially crash.

  [Test Case]
   * Enable RFC5424 format logging by adding the following to /etc/rsyslog.conf
     $ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format
   * Eventually crashes/corruption can occur. The reporter in the upstream bug also had dynamic file templates that could also irritate this bug.

  [Regression Potential]
   * This patch is already present in upstream rsyslogd, and the patch cleanly backports to precise/quantal.
   * This patch modifies the message locking to ensure proper locking using the alternative format. Thus, testing using the traditional (default) format and RFC5424 format are needed.

  [Other Info]
   * Upstream bug: http://bugzilla.adiscon.com/show_bug.cgi?id=296
   * Upstream patch: http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=791b16ce06d75944e338a6e5fa14c0394bde6f1d

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/1059592/+subscriptions