login: pututxline could fail to overwrite existing entries [BZ #24902]

The internal_getut_r function updates the file_offset variable and
therefore must always update last_entry as well.

Previously, if pututxline could not upgrade the read lock to a
write lock, internal_getut_r would update file_offset only,
without updating last_entry, and a subsequent call would not
overwrite the existing utmpx entry at file_offset, instead
creating a new entry.  This has been observed to cause unbounded
file growth in high-load situations.

This commit removes the buffer argument to internal_getut_r and
updates the last_entry variable directly, along with file_offset.

Initially reported and fixed by Ondřej Lysoněk.

Reviewed-by: Gabriel F. T. Gomes <gabrielftg@linux.ibm.com>

1 files changed, 10 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index 34021b7..b6721d1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2019-08-28  Florian Weimer  <fweimer@redhat.com>
+
+	[BZ #24902]
+	* login/Makefile (tests): Add tst-pututxline-lockfail.
+	(tst-pututxline-lockfail): Link with -lpthread.
+	* login/utmp_file.c (internal_getut_r): Remove buffer argument.
+	(__libc_getutid_r): Adjust.
+	(__libc_pututline): Likewise.  Check for file_offset == -1.
+	* login/tst-pututxline-lockfail.c: New file.
+
 2019-08-28  Stefan Liebler  <stli@linux.ibm.com>
 
 	* posix/tst-regex.c (do_test): Use tst-regex.input as input file.