[Bug 1564976] Re: systemd-udevd crashed with SIGSEGV with rules file appending large number of tags

[Martin Pitt]

This crashes in src/libsystemd/sd-device/sd-device.c,
device_properties_prepare():

                char *tags = NULL;
                while ((tag = sd_device_get_tag_next(device)))
                        tags = strjoina(tags, ":", tag);

strjoina() (which essentially is alloca() with some automatic size
determination) is very efficient with a few tags, but it has an
undefined upper bound and undefined behaviour on stack overflow, i. e.
there is no way to find out when it failed.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/1564976

Title:
  systemd-udevd crashed with SIGSEGV with rules file appending large
  number of tags

Status in systemd package in Ubuntu:
  In Progress

Bug description:
  I was doing some testing and found that if I create /etc/udev/rules.d/70-test.rules with:
  KERNEL=="kmsg", TAG+="test.some-test-name.1"
  KERNEL=="kmsg", TAG+="test.some-test-name.2"
  ...
  KERNEL=="kmsg", TAG+="test.some-test-name.10000"

  Then run: 'sudo udevadm trigger', I could reliably trigger this crash.

  
  for i in `seq 10000`; do printf 'KERNEL=="kmsg", TAG+="test%i"\n' $i; done > /etc/udev/rules.d/70-manytags.rules

  ProblemType: Crash
  DistroRelease: Ubuntu 16.04
  Package: udev 229-3ubuntu1
  ProcVersionSignature: Ubuntu 4.4.0-16.32-generic 4.4.6
  Uname: Linux 4.4.0-16-generic x86_64
  ApportVersion: 2.20-0ubuntu3
  Architecture: amd64
  CrashCounter: 1
  CustomUdevRuleFiles: 70-snappy-baz.norf.rules 70-snappy-hello-world.rules 70-snappy_hwassign_hello-world.rules 70-snappy-foo.bar.rules
  Date: Fri Apr  1 10:48:50 2016
  ExecutablePath: /lib/systemd/systemd-udevd
  InstallationDate: Installed on 2015-06-13 (292 days ago)
  InstallationMedia: Ubuntu 15.04 "Vivid Vervet" - Release amd64 (20150422)
  MachineType: Dell Inc. XPS 13 9343
  ProcCmdline: /lib/systemd/systemd-udevd
  ProcEnviron:
   LANG=en_US.UTF-8
   PATH=(custom, no user)
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.4.0-16-generic.efi.signed root=UUID=7bc4dcd2-0bd8-4e42-b8b7-9f1ed6b8a3e9 ro libata.force=noncq kaslr quiet splash vt.handoff=7
  Signal: 11
  SourcePackage: systemd
  StacktraceTop:
   ?? ()
   ?? ()
   ?? ()
   ?? ()
   ?? ()
  Title: systemd-udevd crashed with SIGSEGV
  UpgradeStatus: Upgraded to xenial on 2016-01-12 (80 days ago)
  UserGroups:

  dmi.bios.date: 11/11/2015
  dmi.bios.vendor: Dell Inc.
  dmi.bios.version: A07
  dmi.board.name: 0310JH
  dmi.board.vendor: Dell Inc.
  dmi.board.version: A00
  dmi.chassis.type: 9
  dmi.chassis.vendor: Dell Inc.
  dmi.modalias: dmi:bvnDellInc.:bvrA07:bd11/11/2015:svnDellInc.:pnXPS139343:pvr:rvnDellInc.:rn0310JH:rvrA00:cvnDellInc.:ct9:cvr:
  dmi.product.name: XPS 13 9343
  dmi.sys.vendor: Dell Inc.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1564976/+subscriptions