Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

discover_class_cache is not threadsafe #335

Open
purushottamc opened this issue Dec 17, 2021 · 1 comment
Open

discover_class_cache is not threadsafe #335

purushottamc opened this issue Dec 17, 2021 · 1 comment

Comments

@purushottamc
Copy link

As per analysis,

In our project one thread is trying to use variable discover_class_cache while another one trying to flush it out. so, it seems the node->name vaiable was getting flushed before the discover_class_cache->name variable found NULL during backtrace analysis as mentioned below:

Core was generated by `/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000007f8a640194 in ?? ()
[Current thread is 1 (LWP 9)]

Thread 1 (LWP 9):
#0 strcmp () at ../sysdeps/aarch64/strcmp.S:156
#1 0x0000007f8a779414 in get_class_cache_entry_name (s=s@entry=0x556fcee092 "dbus") at stringrep.c:36
#2 string_to_security_class (s=s@entry=0x556fcee092 "dbus") at stringrep.c:195
#3 0x000000556fce0f8c in bus_selinux_check (sender_sid=sender_sid@entry=0x5572740ce0, override_sid=0x5572747730, requested=requested@entry=0x556fcee1a1 "send_msg", auxdata=auxdata@entry=0x7fe1982c80, target_class=0x556fcee092 "dbus") at ../../dbus-1.12.20/bus/selinux.c:410
#4 0x000000556fce15b4 in bus_selinux_check (target_class=0x556fcee092 "dbus", auxdata=0x7fe1982c80, requested=0x556fcee1a1 "send_msg", override_sid=, sender_sid=0x5572740ce0) at ../../dbus-1.12.20/bus/selinux.c:639
#5 bus_selinux_allows_send (sender=sender@entry=0x5572740760, proposed_recipient=proposed_recipient@entry=0x0, msgtype=0x7f8a8b40a1 "method_call", interface=0x5572741960 "org.freedesktop.DBus", member=0x5572741948 "AddMatch", error_name=0x0, destination=destination@entry=0x5572741980 "org.freedesktop.DBus", activation_entry=activation_entry@entry=0x0, error=error@entry=0x7fe1982e48) at ../../dbus-1.12.20/bus/selinux.c:639
#6 0x000000556fcd3f1c in bus_context_check_security_policy (context=context@entry=0x557272b6b0, transaction=transaction@entry=0x55727453e0, sender=sender@entry=0x5572740760, addressed_recipient=addressed_recipient@entry=0x0, proposed_recipient=proposed_recipient@entry=0x0, message=message@entry=0x55727454a0, activation_entry=activation_entry@entry=0x0, error=error@entry=0x7fe1982e48) at ../../dbus-1.12.20/bus/bus.c:1611
#7 0x000000556fcdbc04 in bus_dispatch (message=0x55727454a0, connection=0x5572740760) at ../../dbus-1.12.20/bus/dispatch.c:383
#8 bus_dispatch_message_filter (connection=0x5572740760, message=0x55727454a0, user_data=) at ../../dbus-1.12.20/bus/dispatch.c:548
#9 0x0000007f8a890408 in dbus_connection_dispatch (connection=0x5572740760) at ../../dbus-1.12.20/dbus/dbus-connection.c:4854
#10 dbus_connection_dispatch (connection=connection@entry=0x5572740760) at ../../dbus-1.12.20/dbus/dbus-connection.c:4726
#11 0x000000556fce6578 in _dbus_loop_dispatch (loop=) at ../../dbus-1.12.20/dbus/dbus-mainloop.c:532
#12 _dbus_loop_dispatch (loop=0x557272b7e0) at ../../dbus-1.12.20/dbus/dbus-mainloop.c:513
#13 0x000000556fce6904 in _dbus_loop_iterate (loop=loop@entry=0x557272b7e0, block=block@entry=1) at ../../dbus-1.12.20/dbus/dbus-mainloop.c:862
#14 0x000000556fce6a70 in _dbus_loop_run (loop=0x557272b7e0) at ../../dbus-1.12.20/dbus/dbus-mainloop.c:888
#15 0x000000556fccff88 in main (argc=7, argv=0x7fe19834c8) at ../../dbus-1.12.20/bus/main.c:724

further debugging:
(gdb) f 1
#1 0x0000007f8a779414 in get_class_cache_entry_name (s=s@entry=0x556fcee092 "dbus") at stringrep.c:36
36 stringrep.c: No such file or directory.
(gdb) print discover_class_cache
$1 = (struct discover_class_node *) 0x0
(gdb) f 2
#2 string_to_security_class (s=s@entry=0x556fcee092 "dbus") at stringrep.c:195
195 in stringrep.c
(gdb) print discover_class_cache
$2 = (struct discover_class_node *) 0x0

@purushottamc
Copy link
Author

Did changes as per above analysis,
#336
Could you please review this change?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant