aboutsummaryrefslogtreecommitdiff
path: root/NEWS
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2015-11-09 12:48:41 +0100
committerFlorian Weimer <fweimer@redhat.com>2015-11-09 12:48:41 +0100
commit2eecc8afd02d8c65cf098cbae4de87f332dc21bd (patch)
treea36cb50020b3836a379e515af5d1874d8d8ea92f /NEWS
parentf3d18efb8a720121066dc3401e822043beb98cde (diff)
downloadglibc-2eecc8afd02d8c65cf098cbae4de87f332dc21bd.zip
glibc-2eecc8afd02d8c65cf098cbae4de87f332dc21bd.tar.gz
glibc-2eecc8afd02d8c65cf098cbae4de87f332dc21bd.tar.bz2
Terminate process on invalid netlink response from kernel [BZ #12926]
The recvmsg system calls for netlink sockets have been particularly prone to picking up unrelated data after a file descriptor race (where the descriptor is closed and reopened concurrently in a multi-threaded process, as the result of a file descriptor management issue elsewhere). This commit adds additional error checking and aborts the process if a datagram of unexpected length (without the netlink header) is received, or an error code which cannot happen due to the way the netlink socket is used. [BZ #12926] Terminate process on invalid netlink response. * sysdeps/unix/sysv/linux/netlinkaccess.h (__netlink_assert_response): Declare. * sysdeps/unix/sysv/linux/netlink_assert_response.c: New file. * sysdeps/unix/sysv/linux/Makefile [$(subdir) == inet] (sysdep_routines): Add netlink_assert_response. * sysdeps/unix/sysv/linux/check_native.c (__check_native): Call __netlink_assert_response. * sysdeps/unix/sysv/linux/check_pf.c (make_request): Likewise. * sysdeps/unix/sysv/linux/ifaddrs.c (__netlink_request): Likewise. * sysdeps/unix/sysv/linux/Versions (GLIBC_PRIVATE): Add __netlink_assert_response.
Diffstat (limited to 'NEWS')
-rw-r--r--NEWS8
1 files changed, 8 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index e2aff3c..4c00e14 100644
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,14 @@ Version 2.23
the following new symbols are used: fts64_children, fts64_close,
fts64_open, fts64_read and fts64_set.
+* getaddrinfo now detects certain invalid responses on an internal netlink
+ socket. If such responses are received, an affected process will
+ terminate with an error message of "Unexpected error <number> on netlink
+ descriptor <number>" or "Unexpected netlink response of size <number> on
+ descriptor <number>". The most likely cause for these errors is a
+ multi-threaded application which erroneously closes and reuses the netlink
+ file descriptor while it is used by getaddrinfo.
+
* A defect in the malloc implementation, present since glibc 2.15 (2012) or
glibc 2.10 via --enable-experimental-malloc (2009), could result in the
unnecessary serialization of memory allocation requests across threads.