exportfs crash with long path

Bug #1062022 reported by Ivan Romanov
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
nfs-utils (Ubuntu)
Fix Released
High
Unassigned

Bug Description

How reproducible:
always

Steps to Reproduce:
# mkdir -p /home/kudinae/Общедоступные
# echo '/home/kudinae/Общедоступные oek-1(rw,sync,no_wdelay,no_root_squash,no_subtree_check)' > /etc/exports
# exportfs -a
Segmentation fault

I've obtained the sources. So a crush happens on export.c:293. variable pos has negative value. I think problem into strtoint and export_hash functions. strtoint has unsigned type and always returns positive value but export_hash impicity cast it to signed int. So it is possible to get negative value.
I wrote patch to fix this.

Tags: patch
Revision history for this message
Ivan Romanov (drizt) wrote :
Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "patch" of this bug report has been identified as being a patch. The ubuntu-reviewers team has been subscribed to the bug report so that they can review the patch. In the event that this is in fact not a patch you can resolve this situation by removing the tag 'patch' from the bug report and editing the attachment so that it is not flagged as a patch. Additionally, if you are member of the ubuntu-reviewers team please also unsubscribe the team from this bug report.

[This is an automated message performed by a Launchpad user owned by Brian Murray. Please contact him regarding any issues with the action taken in this bug report.]

tags: added: patch
Ivan Romanov (drizt)
security vulnerability: no → yes
security vulnerability: yes → no
Revision history for this message
Dave Gilbert (ubuntu-treblig) wrote :

Triaged: Reporter has explanation of bug, detailed and with patch
High: Crash in core package

Your diagnosis looks right - nice find!

Changed in nfs-utils (Ubuntu):
importance: Undecided → High
status: New → Triaged
Revision history for this message
Dave Gilbert (ubuntu-treblig) wrote :

I suspect the problem is caused by the top-bit set non-ascii characters in your path rather than the length of the string.
While I think your patch is sufficient, I'd actually fix:
   * The cast of (int) in strtoint and change it to a (unsigned int)
   * and the type of export_hash

Dave

Revision history for this message
Ivan Romanov (drizt) wrote :

strtoint has unsigned int type. no need to use any cast.
type of export_hash is insignificant because division of module always will be positive. num alway positive and HASH_TABLE_SIZE always positive (it is DEFINE and it can be any value but if it will non positive it will be error). So division a positive by a positive will always a positive. In function uses modulo operation so result will be sufficient small to fit in int.

in any case patch was applied by upstream
http://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commitdiff;h=a16f4a13677d13b0aae9327a3b9e8414470b7927

Steve Langasek (vorlon)
Changed in nfs-utils (Ubuntu):
status: Triaged → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (3.6 KiB)

This bug was fixed in the package nfs-utils - 1:1.2.8-2ubuntu1

---------------
nfs-utils (1:1.2.8-2ubuntu1) saucy; urgency=low

  [ Stéphane Graber ]
  * Merge from Debian unstable.
    - includes upstream fix for gssd -R. LP: #1179992.
    - includes upstream fix for an exportfs crash when using long paths.
      LP: #1062022.
  * Remaining changes:
    - debian/nfs-common.{statd,statd-mounting,gssd,idmapd}.upstart,
      debian/control, debian/nfs-common.{preinst,postinst,prerm,postrm},
      debian/rules: drop nfs-common init script in favor of upstart jobs,
      and build-depend on debhelper (>= 7.3.15ubuntu3) for correct upstart
      init handling.
    - Depend on rpcbind (>= 0.2.0-6ubuntu1) for upstart support.
    - debian/nfs-kernel-server.postinst: don't call "invoke-rc.d nfs-common"
      in the postinst, this is redundant anyway and the nfs-common init script
      is gone now.
    - nfs-kernel-server.init: Unmount nfsd fs when init script stops
    - Allow issuing options to rpc.nfsd
    - debian/nfs-common.defaults: always start idmapd automatically; drop
      the configuration option.
    - Move /var/lib/nfs/rpc_pipefs to /run/rpc_pipefs. This does not belong
      in /var/lib.
    - Add "-e" (ticket expiry is error) option to rpc.gssd to prevent hangs due
      to EKEYEXPIRED error from kernel on ticket expiry. LP: #794112
    - Adjust upstart jobs to treat TYPE=nfs and TYPE=nfs4 mounts identically,
      since TYPE=nfs4 is considered deprecated.
    - Fix various boot-time race conditions between mountall and nfs-utils by
      moving handling of the 'mounting' events to separate gssd-mounting and
      idmapd-mounting jobs. Requires mountall 2.41 or better to avoid deadlock
      on boot. LP: #643289, LP: #611397.
    - Fix the stop conditions: never stop on 'runlevel [06]' since that gives
      the system no time to cleanly unmount nfs mounts; instead, stop only on
      the unmounted-remote-filesystems event. LP: #569094.
    - Newer versions of gssd don't talk to portmap, so don't make the upstart
      job depend on it.
    - Add an instance to statd-mounting, and change it to just wait for statd
      instead of trying to trigger it potentially out of order. This also
      means we don't need to try to force portmap to start from statd.

  [ Steve Langasek ]
  * Build --with-gssglue; linking directly against libgssapi-krb5 results in
    rpc.gssd trying to incorrectly pass opaque pointers between two different
    gss implementations (via libtirpc).

nfs-utils (1:1.2.8-2) unstable; urgency=medium

  * Fix reportbug scripts to use rpcinfo in /usr/sbin.
  * Add id_resolver.conf to fix nfsidmap invocation
    (Closes: #708156, #638157, #707960).
  * Remove autogenerated roff as nfsdcltrack.man is meant to be used
    as the actual source according to author (Closes: #707908).

nfs-utils (1:1.2.8-1) unstable; urgency=low

  * New upstream version (Closes: #707258).
    - Only amend extra-options on a successful vers=4 mount
      (Closes: #690181).
    - Use default domain (Closes: #657188).
    - Fix is-subdirectory to understand '/' (Closes: #685306).
    - Drop 18-osd_login-sbindir: incorporated upstream.
    ...

Read more...

Changed in nfs-utils (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Patches

Remote bug watches

Bug watches keep track of this bug in other bug trackers.