Skip to content

(RHEL-133355) encountering ordering cycle triggers segmentation fault#459

Merged
mrc0mmand merged 17 commits intoredhat-plumbers:rhel-8.8.0from
tcornell-bus:RHEL-133355
Jan 12, 2026
Merged

(RHEL-133355) encountering ordering cycle triggers segmentation fault#459
mrc0mmand merged 17 commits intoredhat-plumbers:rhel-8.8.0from
tcornell-bus:RHEL-133355

Conversation

@tcornell-bus
Copy link

@tcornell-bus tcornell-bus commented Jan 9, 2026

Backport RHEL-8.10 RHEL-132317 first PR:
The generated string may include %, which will confuse both the xprintf call, and the VA_FORMAT_ADVANCE macro.

Pass the generated string as an argument to a "%s" format string instead.

(cherry picked from commit 7325a2b)

Resolves: RHEL-133355


Backport RHEL-8.10 RHEL-132317 second PR:
This is trivially exploitable (in the sense of causing a crash from SEGV) e.g. by 'shutdown now "Message %s %s %n"'. The message is settable through polkit, but is limited to auth_admin:

<action id="org.freedesktop.login1.set-wall-message">
         <description gettext-domain="systemd">Set a wall message</description>
         <message gettext-domain="systemd">Authentication is required to set a wall message</message>
         <defaults>
                <allow_any>auth_admin_keep</allow_any>
                <allow_inactive>auth_admin_keep</allow_inactive>
                <allow_active>auth_admin_keep</allow_active>
        </defaults>
</action>

Bug introduced in 9ef1502 ('logind/systemctl: introduce SetWallMessage and --message', 2015-09-15).

(cherry picked from commit 0cb09bc)

Related: RHEL-133355


Fix CI issues by backporting PRs referenced in comment1 and comment2. I left out this commit, since it is removing an unused variable from a file that does not exist in the rhel-8.8.0 branch.

a1291762 and others added 5 commits January 9, 2026 13:39
The generated string may include %, which will confuse both the
xprintf call, and the VA_FORMAT_ADVANCE macro.

Pass the generated string as an argument to a "%s" format string
instead.

(cherry picked from commit 7325a2b)

Resolves: RHEL-133355
…string

Follow-up for 924775e.

The loop run with `STRV_FOREACH_PAIR()`, hence `if (*(unit_id+1))` is
not a good way to detect if there exist a next entry.

Fixes #26872.

(cherry picked from commit 366eced4c81a15a25b9225347fa203aa67798b02)

Resolves: RHEL-133355
(cherry picked from commit 999f16514367224cbc50cb3ccc1e4392e43f6811)

Related: RHEL-133355
As we ignores the failure in merge_unit_ids(), so unit_ids may be NULL.

(cherry picked from commit 5803c24da5cf543a55c4fce9009a9c5f2b18519a)

Related: RHEL-133355
This is trivially exploitable (in the sense of causing a crash from SEGV) e.g.
by 'shutdown now "Message %s %s %n"'. The message is settable through polkit,
but is limited to auth_admin:

<action id="org.freedesktop.login1.set-wall-message">
         <description gettext-domain="systemd">Set a wall message</description>
         <message gettext-domain="systemd">Authentication is required to set a wall message</message>
         <defaults>
                <allow_any>auth_admin_keep</allow_any>
                <allow_inactive>auth_admin_keep</allow_inactive>
                <allow_active>auth_admin_keep</allow_active>
        </defaults>
</action>

Bug introduced in 9ef1502
('logind/systemctl: introduce SetWallMessage and --message', 2015-09-15).

(cherry picked from commit 0cb09bc)

Related: RHEL-133355
@tcornell-bus tcornell-bus changed the title encountering ordering cycle triggers segmentation fault (RHEL-133355) encountering ordering cycle triggers segmentation fault Jan 9, 2026
@github-actions github-actions bot added rhel-8.8.0 pr/needs-ci Formerly needs-ci pr/needs-review Formerly needs-review labels Jan 9, 2026
@github-actions
Copy link

github-actions bot commented Jan 9, 2026

Commit validation

Tracker - RHEL-133458

The following commits meet all requirements

commit upstream
2c9b281 - pid1: do not use generated strings as format strings (#19098) systemd/systemd@7325a2b
ddecef8 - core/transaction: make merge_unit_ids() always return NUL-terminated s… systemd/systemd@366eced
cdea2a7 - core/transaction: make merge_unit_ids() return non-NULL on success systemd/systemd@999f165
df4fade - core/transaction: do not log "(null)" systemd/systemd@5803c24
c7837f8 - logind: fix crash in logind on user-specified message string systemd/systemd@0cb09bc
a5bdf2b - ci: update actions/upload-artifact to v4 rhel-only
8469096 - ci: point C8S containers to the Vault rhel-only
bb9b6ff - ci: bump the worker Ubuntu version to Jammy rhel-only
81f399f - test-execute: let's ignore the difference between CLD_KILLED and CLD_D… systemd/systemd@c3ab2c3
8878ed7 - test-execute: turn off coredump generation in test services systemd/systemd@a429223

Tracker validation

Success

🟢 Tracker RHEL-133458 has set desired product: rhel-8.6.0.z
🟢 Tracker RHEL-133458 has set desired component: systemd
🟢 Tracker RHEL-133458 has been approved
🟢 Tracker RHEL-133458 has set severity


Pull Request validation

Success

🟡 CI - Waived
🟢 Review - Reviewed by a member
🟢 Approval - Changes were approved


Auto Merge

Failed

🔴 Pull Request has unsupported target branch rhel-8.6.0, expected branches are: 'main,master'

Success

🟢 Pull Request is not marked as draft and it's not blocked by dont-merge label
🟢 Pull Request meet requirements, title has correct form
🟢 Pull Request meet requirements, mergeable is true
🟠 Pull Request meet requirements, mergeable_state is unstable

@mrc0mmand
Copy link
Member

All current CI fails are expected:

@tcornell-bus could you, please, backport at least the last two patches for GH Actions, as they're quite easy to backport? I'll leave the decision whether to backport the first two patch sets on you, since they're quite substantial (compared to the rest).

jamacku and others added 10 commits January 12, 2026 09:26
Temporarily point repos in C8S containers to the Vault (since C8S is
EOL), until we figure out a _proper_ solution.

rhel-only
Related: RHEL-133355
The expect stuff was anything but expected, so let's just backport
the upstream test case and tweak it a bit to account for the missing
parts in our downstream testing infrastructure.

Follow-up to 638c241.
Related: RHEL-133355
rhel-only
Signed-off-by: Luís Ferreira <contact@lsferreira.net>
(cherry picked from commit ccf4784)

Related: RHEL-133355
Loosely cherry-picked from aa549ff.

rhel-only
Related: RHEL-133355
In the past we didn't have any matches like that, so the parser was stricter
than necessary, but now we have, so allow that.

(cherry picked from commit 457763a)

Related: RHEL-133355
This includes changes for hwdb/parse_hwdb.py from commits:
  - c0b2e69
  - d7d3169
  - a136c2c
  - and possibly others

The hwdb changes from these commits were backported as part of
793dc4d.

rhel-only
Related: RHEL-133355
pyparsing 2.3.1/2.4.0 had some changes to grouping of And matches, and as a
result we'd report 0 properties and 0 matches, and not really do any checks.

With this change we get identical behaviour for pyparsing 2.3.1, 2.4.0, 2.4.2:

$ hwdb/parse_hwdb.py
hwdb/60-evdev.hwdb: 72 match groups, 94 matches, 262 properties
hwdb/60-input-id.hwdb: 3 match groups, 3 matches, 4 properties
hwdb/60-keyboard.hwdb: 173 match groups, 256 matches, 872 properties
Keycode KBD_LCD_MENU1 unknown
Keycode KBD_LCD_MENU4 unknown
Keycode KBD_LCD_MENU2 unknown
Keycode KBD_LCD_MENU3 unknown
hwdb/60-sensor.hwdb: 101 match groups, 120 matches, 105 properties
hwdb/70-joystick.hwdb: 2 match groups, 3 matches, 2 properties
hwdb/70-mouse.hwdb: 104 match groups, 119 matches, 123 properties
hwdb/70-pointingstick.hwdb: 8 match groups, 30 matches, 11 properties
hwdb/70-touchpad.hwdb: 6 match groups, 9 matches, 6 properties

(cherry picked from commit 2382a2e)

Related: RHEL-133355
@mrc0mmand
Copy link
Member

mrc0mmand commented Jan 12, 2026

Thank you! One last thing I forgot - the test-execute fail can be resolved by backporting:

The remaining test-fs-util fail is a known issue (#434) and has no fix/workaround yet.

…DUMPED

Depending on system configuration and whether SCMP_ACT_KILL_PROCESS or SCMP_ACT_KILL_THREAD is available/used processes might coredump on specific coredumps or are just plain killed. For our test case the difference doesn't really matter, hence let's hide it away.

(cherry picked from commit c3ab2c3)

Related: RHEL-133355
These services are likely to coredump, and we expect that but aren't interested in the coredump. Hence let's turn off processing by setting RLIMIT_CORE to 0/0.

(cherry picked from commit a429223)

Related: RHEL-133355
Copy link
Member

@mrc0mmand mrc0mmand left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thank you!

@github-actions github-actions bot added pr/needs-manual-merge and removed pr/needs-ci Formerly needs-ci pr/needs-review Formerly needs-review labels Jan 12, 2026
@mrc0mmand mrc0mmand merged commit 6c66dae into redhat-plumbers:rhel-8.8.0 Jan 12, 2026
7 of 9 checks passed
@jamacku
Copy link
Member

jamacku commented Jan 13, 2026

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants