Bugzilla – Bug 1218087
LTP: glibc syscall wrapper function access the invalid pointer lead crash in 32-bit compatibility mode
Last modified: 2024-06-17 12:15:26 UTC
NOTE: this issue similar to https://bugzilla.suse.com/show_bug.cgi?id=1217134 and i suppose we DO NOT need a fix. I just use this issue to flag LTP openqa failed case for 15sp6. ## Openqa failed test suite link: openQA test in scenario sle-15-SP6-Online-x86_64-ltp_syscalls_m32@64bit fails in [recvmmsg01](https://openqa.suse.de/tests/13021758/modules/recvmmsg01/steps/7) Run the LTP system call tests in 32-bit compatibility mode (failures are usually less serious than failures on regular ltp_syscalls). following LTP cases all impact by this issue: recvmmsg01/mq_timedreceive01/mq_timedsend01/sigtimedwait01 ## Root cause LTP case create a bad address(timeout) with no access permission and give it recvmmsg function, new version glibc(2.38) will handle this parameter instead of directly deliver to kernel, so when glibc start access this bad address(timeout), a SIGSEGV will happen. LTP code part: timeout = mmap(0, 1, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0); recvmmsg(*tc->fd, *tc->msg_vec, VLEN, 0, timeout) Glibc part: struct __timespec64 ts64, *pts64 = NULL; if (timeout != NULL) { ts64 = valid_timespec_to_timespec64 (*timeout); <<<<<<<< pts64 = &ts64;
It will be retest with next snapshot
Can be closed after Beta3 Release
It seems this issue is not able to reproduce , no further action by the reporter .
First, this issue is still reproducible on both latest 15-SP6 [1] (we marked here is as WONTFIX, is that correct?) and latest KOTD [2] (on all 4 syscalls). Shouldn't be reopened or changed resolution to WONTFIX? Also it fails on current Tumbleweed [3] (kernel 6.8.9), which suggests it's not fixed in mainline. Shell I open a separate bug for Tumbleweed? [1] https://openqa.suse.de/tests/14306484#step/mq_timedreceive01/8 [2] https://openqa.suse.de/tests/14296269#step/mq_timedreceive01/8 [3] https://openqa.opensuse.org/tests/4188022#step/mq_timedreceive01/8
*** Bug 1226427 has been marked as a duplicate of this bug. ***