So what is going on is this:

In icmp6_receive systemd passes a buffer for control messages to recvmsg
that is only big enough for the messages it expects to receive. glibc
now attempts to append an extra control message to the buffer
(translating SO_TIMESTAMP / COMPAT_SO_TIMESTAMP_OLD to SO_TIMESTAMP_NEW)
and sets MSG_CTRUNC in flags if it can't fit this in. So this is where
that EXFULL comes from.
So the fix for this is simple, right? Just pass a bigger buffer to
recvmsg? No, if you do this networkd segfaults. I think
__convert_scm_timestamps fails to handle a subtlety of the control
message buffer, which is that the control messages don't always (it
seems) occupy all of the buffer up to msg_controllen (!). If you look at
the definition of CMSG_NXTHDR, the test for the end of the buffer has
two clauses
(https://sourceware.org/git/?p=glibc.git;a=blob;f=bits/socket.h;h=05ac0249c7da7218cbd11be99a67529161cfa7f7;hb=HEAD#l265):

  if ((unsigned char *) (__cmsg + 1) > ((unsigned char *) __mhdr->msg_control
                                        + __mhdr->msg_controllen)
      || ((unsigned char *) __cmsg + CMSG_ALIGN (__cmsg->cmsg_len)
          > ((unsigned char *) __mhdr->msg_control + __mhdr->msg_controllen)))
    /* No more entries.  */
    return (struct cmsghdr *) 0;

I think after glibc's alterations, calling this on the last message ends
up with garbage in __cmsg->cmsg_len, so __cmsg+__cmsg->cmsg_len is
overflowing and the program then goes off to read uninitialized memory
and hilarity ensues.

I'm attaching a glibc patch which *may* help (it's building in a ppa
now, will test it in a bit). But it's all a bit uncertain. Haven't filed
an upstream glibc bug report yet.

** Patch added: "lp1940635.patch"
   
https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/1940635/+attachment/5521376/+files/lp1940635.patch

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/1940635

Title:
  systemd-networkd failing to acquire a DHCP6 lease from dnsmasq on
  armhf

Status in glibc package in Ubuntu:
  New
Status in netplan.io package in Ubuntu:
  New
Status in systemd package in Ubuntu:
  New

Bug description:
  systemd-networkd is failing to acquire a DCHP6 lease from dnsmasq on
  armhf since glibc 2.34-0ubuntu1, failing systemd (tests-name=networkd-
  test.py) and netplan.io (test-name=ethernets) tests on armhf.

  Reproducer:
  * Setup an armhf container, e.g. via:
  autopkgtest systemd --test-name=networkd-test.py --shell -U 
--apt-pocket=proposed=src:systemd,src:glibc -s -- lxd 
autopkgtest/ubuntu/impish/armhf
  * It will fail and drop you into the shell
  * cd test/ && apt install python3-nose
  * nosetests3 -v -s -m "test_.*_dhcp_ip6" networkd-test.py

  
  This is unrelated to the recent dnsmasq changes (LP: #1894619), as that would 
fail on all architectures, not just armhf.

  It still passes inside an amd64 LXD container, so it is also not related to 
armhf being tested inside a container. But it shows the difference between 
armhf vs amd64 container, that on armhf we're missing the DHCPSOLICIT (and 
therefore DHCPREPLY) messages, as can be seen from the dnsmasq log:
  dnsmasq-dhcp[]: DHCPSOLICIT(router_eth42) 
00:02:00:00:ab:11:57:1e:20:2f:9e:56:5f:34 
  dnsmasq-dhcp[]: DHCPREPLY(router_eth42) 2600::1f 
00:02:00:00:ab:11:57:1e:20:2f:9e:56:5f:34 autopkgtest-lxd-rtypaf

  The issue is most probably the same that causes the currently failing
  netplan.io/ethernets autopkgtest on armhf, if tested against glibc
  2.34-0ubuntu1.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/1940635/+subscriptions


-- 
Mailing list: https://launchpad.net/~touch-packages
Post to     : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp

Reply via email to