Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 416361 - app-arch/dump-0.4.44-r1 restore crashes restoring UNIX-domain socket with very long name
Summary: app-arch/dump-0.4.44-r1 restore crashes restoring UNIX-domain socket with ver...
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Core system (show other bugs)
Hardware: AMD64 Linux
: Normal normal (vote)
Assignee: Gentoo's Team for Core System packages
Keywords: PATCH
Depends on:
Reported: 2012-05-17 09:07 UTC by Christopher Head
Modified: 2016-05-09 05:59 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Patch to fix the crash (dump-socket-crash.patch,817 bytes, patch)
2012-05-17 09:24 UTC, Christopher Head
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Head 2012-05-17 09:07:48 UTC
I created a UNIX-domain socket with an extremely long name: the filesystem root contains a directory whose name is 100 characters long, that directory contains another directory whose name is also 100 characters long, and that directory contains a UNIX-domain socket called "sock". When I dump this filesystem using "dump -0 -a -f ~/test.dump -h 0 -v /dev/vg0/foo", re-mkfs the filesystem, mount it, CD into it, and run "restore -r -f ~/test.dump -v", I get a crash due to buffer overflow detected right after the "extract socket" line of output.

I figure this will be easy to reproduce, but if it isn't, I can gather more info.

The cause is pretty straightforward: in dump's source code, in restore/tape.c, on line 870, it tries to strcpy() the complete name of the socket into the sun_path member of a sockaddr_un, which of course blows right past the buffer. One solution would be to chdir() into the containing directory and make sure to check the name length before copying it in; a much easier solution would be to simply use mknod() instead of bind() to create the inode, since this works with arbitrarily long filenames.

This is not an academic problem: a UNIX domain socket inside an ecryptfs-protected directory will end up having a very long name once its filename is encrypted for storage on the underlying filesystem.

Reproducible: Always

# emerge --info app-arch/dump
Portage (default/linux/amd64/10.0, gcc-4.5.3, glibc-2.14.1-r3, 3.2.12-gentoo x86_64)
                         System Settings
System uname: Linux-3.2.12-gentoo-x86_64-Intel-R-_Core-TM-_i7_CPU_Q_720_@_1.60GHz-with-gentoo-2.0.3
Timestamp of tree: Thu, 17 May 2012 03:15:01 +0000
app-shells/bash:          4.2_p20
dev-java/java-config:     2.1.11-r3
dev-lang/python:          2.7.3-r1, 3.2.3
dev-util/cmake:           2.8.7-r5
dev-util/pkgconfig:       0.26
sys-apps/baselayout:      2.0.3
sys-apps/sandbox:         2.5
sys-devel/autoconf:       2.13, 2.68
sys-devel/automake:       1.11.1
sys-devel/binutils:       2.21.1-r1
sys-devel/gcc:            4.5.3-r2
sys-devel/gcc-config:     1.5-r2
sys-devel/libtool:        2.4-r1
sys-devel/make:           3.82-r1
sys-kernel/linux-headers: 3.1 (virtual/os-headers)
sys-libs/glibc:           2.14.1-r3
Repositories: gentoo kruskal-local sunrise hawk777
ACCEPT_LICENSE="* -@EULA AdobeFlash-10.3 dlj-1.1 google-talkplugin Oracle-BCLA-JavaSE skype-eula"
CFLAGS="-O2 -pipe -march=native -fomit-frame-pointer"
CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt /var/lib/hsqldb"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-O2 -pipe -march=native -fomit-frame-pointer"
EMERGE_DEFAULT_OPTS="--jobs 3 --load-average 8 --with-bdeps y"
FEATURES="assume-digests binpkg-logs distlocks ebuild-locks fixlafiles news parallel-fetch protect-owned sandbox sfperms sign strict unknown-features-warn unmerge-logs unmerge-orphans userfetch xattr"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
LINGUAS="en en_CA"
MAKEOPTS="--jobs 8 --load-average 8"
PORTAGE_RSYNC_EXTRA_OPTS="--exclude ChangeLog --delete-excluded"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTDIR_OVERLAY="/usr/local/portage /var/lib/layman/sunrise /home/chead/portage"
USE="X a52 aac acpi aio alsa amd64 archive bluetooth bzip2 cairo caps cdda cddb cdinstall cdio cli css cups custom-optimization cxx dbus dillo double-precision dri dvd faac faad fat ffmpeg fftw flac fontconfig fortran gcrypt gif gimp glade gmp gnutls gtk hou hpn iconv idn imap ios java jce joystick jpeg laptop libnotify libsamplerate mbox mikmod mmx modules mp3 mpeg multilib multiuser ncurses nls nntp nowin nptl ntfs ntp offensive ogg opengl openmp pam pdf plotutils png pppd readline scanner sdl session sou spell sse sse2 startup-notification stream svg symlink taglib theora thunar tiff truetype unicode usb vdpau videos vim-syntax vorbis xattr xft xinerama xorg xscreensaver xulrunner xv xvid xvmc zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="evdev synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en en_CA" PHP_TARGETS="php5-3" PYTHON_TARGETS="python3_2 python2_7" QEMU_SOFTMMU_TARGETS="i386 x86_64" RUBY_TARGETS="ruby18" SANE_BACKENDS="plustek" USERLAND="GNU" VIDEO_CARDS="nvidia" XFCE_PLUGINS="logout menu" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"

                        Package Settings

app-arch/dump-0.4.44-r1 was built with the following:
USE="(multilib) readline -debug -ermt (-selinux) -static"
Comment 1 Christopher Head 2012-05-17 09:24:06 UTC
Created attachment 312095 [details, diff]
Patch to fix the crash

As a matter of fact, I can empirically confirm that changing all the socket-restoring stuff to a single mknod() call does, in fact, fix the crash, and in the process also fixes a file descriptor leak in an error path (specifically the bind() failure case). I've attached a patch.
Comment 2 SpanKY gentoo-dev 2016-05-09 05:59:40 UTC
i've pushed your fix upstream:

in the future, please post your patches upstream rather than here.