Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-67176

systemd-resolved crashes because of a use-after-free

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Normal Normal
    • None
    • rhel-8.10
    • systemd
    • None
    • No
    • Moderate
    • rhel-sst-cs-plumbers
    • ssg_core_services
    • 3
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • None
    • None
    • None
    • None

      What were you trying to do that didn't work?

      A customer sees systemd-resolved crash from time to time when reading a hashmap.
      This occurs when an event is received while the request has been completed already.
      The RHEL8 code clearly states it's a bug in the code to have a caller access the query:

       520 static void dns_query_complete(DnsQuery *q, DnsTransactionState state) {
       521         assert(q);
       522         assert(!DNS_TRANSACTION_IS_LIVE(state));
       523         assert(DNS_TRANSACTION_IS_LIVE(q->state));
       524 
       525         /* Note that this call might invalidate the query. Callers
       526          * should hence not attempt to access the query or transaction
       527          * after calling this function. */
       528 
       529         q->state = state;
       530 
       531         dns_query_stop(q);
       532         if (q->complete)
       533                 q->complete(q);
       534 }
      

      Using a ASAN build, I could find that this was exactly matching the following commit:

      commit c856ef0457c35e9edfdbf085b69ec81c126d48e5
      Author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
      Date:   Fri May 14 10:49:24 2021 +0200
      
          resolved: fix braino with reference counting and linked lists
          
          In 0e0fd08fc832b8f42e567d722d388eba086da5ff I added reference counts to keep
          track of the DnsQueryCandidate objects. Unfortunately, dns_query_unref_candidates()
          was written as
          
               while (q->candidates)
                     dns_query_candidate_unref(q->candidates);
          
          i.e. it would keep dropping the reference count as many times as needed for it
          to hit 0, making the patch less than fully effective.
          
          dns_query_unref_candidates() is renamed to dns_query_detach_candidates() and
          changed to drop exactly one reference from each of the linked candidates.
      [...]
      

      I'm attaching the ASAN report.

      What is the impact of this issue to you?

      Crashes

      Please provide the package NVR for which the bug is seen:

      systemd-239-78.el8

      How reproducible is this bug?:

      Often on customer systems

              systemd-maint systemd maint mailing list
              rhn-support-rmetrich Renaud Métrich
              systemd maint mailing list systemd maint mailing list
              Frantisek Sumsal Frantisek Sumsal
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: