NetBSD Problem Report #56874

From www@netbsd.org  Thu Jun  9 22:36:50 2022
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 319201A921F
	for <gnats-bugs@gnats.NetBSD.org>; Thu,  9 Jun 2022 22:36:50 +0000 (UTC)
Message-Id: <20220609223648.8CD891A923C@mollari.NetBSD.org>
Date: Thu,  9 Jun 2022 22:36:48 +0000 (UTC)
From: tgl@sss.pgh.pa.us
Reply-To: tgl@sss.pgh.pa.us
To: gnats-bugs@NetBSD.org
Subject: /usr/sbin/ipftest frequently dumps core due to uninitialized variable
X-Send-Pr-Version: www-1.0

>Number:         56874
>Category:       bin
>Synopsis:       /usr/sbin/ipftest frequently dumps core due to uninitialized variable
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jun 09 22:40:00 +0000 2022
>Closed-Date:    Fri Jun 10 06:05:39 +0000 2022
>Last-Modified:  Fri Jun 10 06:05:39 +0000 2022
>Originator:     Tom Lane
>Release:        HEAD/202206081310Z
>Organization:
PostgreSQL Global Development Group
>Environment:
NetBSD sss2.sss.pgh.pa.us 9.99.97 NetBSD 9.99.97 (SD0) #3: Thu Jun  9 15:19:02 EDT 2022  tgl@nuc1.sss.pgh.pa.us:/home/tgl/netbsd-H-202206081310Z/obj.hppa/sys/arch/hppa/compile/SD0 hppa
>Description:
I noticed that a lot of the /usr/tests/ipf tests fail on my HPPA box due to core dumps in ipftest.  A bit of debugging found that these were SIGSEGVs caused by following garbage pointers in the "mb_t mb" struct that's a local in main().  The tests are completely clean after the attached quick-hack fix.  I speculate that the program appears to work on other arches because their stacks tend to start out all-zero; but this ain't so on HPPA (and I doubt it's considered guaranteed anywhere).

>How-To-Repeat:
Run ipf tests using atf-run, on a platform that doesn't pre-zero the stack.

>Fix:
Zeroing the "mb" variable like this fixes it for me:

Index: external/bsd/ipf/dist/tools/ipftest.c
===================================================================
RCS file: /cvsroot/src/external/bsd/ipf/dist/tools/ipftest.c,v
retrieving revision 1.4
diff -u -r1.4 ipftest.c
--- external/bsd/ipf/dist/tools/ipftest.c       4 Feb 2018 08:19:42 -0000       1.4
+++ external/bsd/ipf/dist/tools/ipftest.c       9 Jun 2022 22:18:55 -0000
@@ -88,6 +88,7 @@
        ip_t    *ip;

        m = &mb;
+       memset(m, 0, sizeof(*m));
        dir = 0;
        dump = 0;
        hlen = 0;


This is kind of an ugly fix --- it seems like there should be someplace else in the program that's responsible for initializing mb_t structs to a valid state.  I did not see a better candidate in a cursory look, though.

>Release-Note:

>Audit-Trail:
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/56874 CVS commit: src/external/bsd/ipf/dist/tools
Date: Fri, 10 Jun 2022 06:06:00 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Fri Jun 10 06:06:00 UTC 2022

 Modified Files:
 	src/external/bsd/ipf/dist/tools: ipftest.c

 Log Message:
 PR 56874: avoid using uninitialized memory, patch from Tom Lane.


 To generate a diff of this commit:
 cvs rdiff -u -r1.4 -r1.5 src/external/bsd/ipf/dist/tools/ipftest.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: martin@NetBSD.org
State-Changed-When: Fri, 10 Jun 2022 06:05:39 +0000
State-Changed-Why:
Patch applied, thanks!


>Unformatted:

Home	PR Database Search