From 447894be41e72d89182437821d82f6fa35011dc5 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Thu, 19 Oct 2023 16:12:45 +0200 Subject: [PATCH 1/3] test: add a real-world state to the corpus To give the fuzzer a nice head start. --- test/fuzz/fuzz-execute-serialize/state | 74 ++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 test/fuzz/fuzz-execute-serialize/state diff --git a/test/fuzz/fuzz-execute-serialize/state b/test/fuzz/fuzz-execute-serialize/state new file mode 100644 index 0000000000..a417a41315 --- /dev/null +++ b/test/fuzz/fuzz-execute-serialize/state @@ -0,0 +1,74 @@ +exec-context-environment=TERM=linux +exec-context-umask=0022 +exec-context-protect-home=no +exec-context-protect-system=no +exec-context-ignore-sigpipe=yes +exec-context-keyring-mode=private +exec-context-protect-proc=default +exec-context-proc-subset=all +exec-context-runtime-directory-preserve-mode=no +exec-context-directories-RuntimeDirectory=0755 +exec-context-directories-StateDirectory=0755 +exec-context-directories-CacheDirectory=0755 +exec-context-directories-LogsDirectory=0755 +exec-context-directories-ConfigurationDirectory=0755 +exec-context-limit-NOFILE=1024:524288 +exec-context-limit-MEMLOCK=8388608 +exec-context-std-input=null +exec-context-std-output=journal +exec-context-std-error=inherit +exec-context-stdio-as-fds=yes +exec-context-tty-rows=4294967295 +exec-context-tty-columns=4294967295 +exec-context-syslog-priority=30 +exec-context-syslog-level-prefix=yes +exec-context-log-level-max=-1 +exec-context-mount-propagation-flag=0 +exec-context-utmp-mode=init +exec-context-syscall-errno=2147483646 +exec-context-mount-image=/foo.raw /run/img2:3 root:nosuid + +exec-command-path=mount +exec-command-argv=mount +exec-command-flags=0 + +exec-parameters-runtime-scope=system +exec-parameters-environment=LANG=C.UTF-8 +exec-parameters-environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin +exec-parameters-flags=13855 +exec-parameters-cgroup-supported=1965 +exec-parameters-cgroup-path=/system.slice/run-u26.service +exec-parameters-cgroup-id=3376 +exec-parameters-prefix-directories-RuntimeDirectory=/run +exec-parameters-prefix-directories-StateDirectory=/var/lib +exec-parameters-prefix-directories-CacheDirectory=/var/cache +exec-parameters-prefix-directories-LogsDirectory=/var/log +exec-parameters-prefix-directories-ConfigurationDirectory=/etc +exec-parameters-stdin-fd=44 +exec-parameters-stdout-fd=45 +exec-parameters-stderr-fd=63 +exec-parameters-user-lookup-fd=65 +exec-parameters-unit-id=run-u26.service +exec-parameters-invocation-id-string=fd06144c3fc64436b42b30b2eb8189ee + + +exec-cgroup-context-cpu-accounting=yes +exec-cgroup-context-memory-accounting=yes +exec-cgroup-context-tasks-accounting=yes +exec-cgroup-context-allowed-cpus= +exec-cgroup-context-startup-allowed-cpus= +exec-cgroup-context-allowed-memory-nodes= +exec-cgroup-context-startup-allowed-memory-nodes= +exec-cgroup-context-tasks-max-value=15 +exec-cgroup-context-tasks-max-scale=100 +exec-cgroup-context-device-policy=auto +exec-cgroup-context-managed-oom-swap=auto +exec-cgroup-context-managed-oom-memory-pressure=auto +exec-cgroup-context-managed-oom-memory-pressure-limit=0 +exec-cgroup-context-managed-oom-preference=none +exec-cgroup-context-memory-pressure-watch=auto +exec-cgroup-context-memory-pressure-threshold-usec=200000 +exec-cgroup-context-ip-address-allow-reduced=yes +exec-cgroup-context-ip-address-deny-reduced=yes + + From 4701425dd58f90f8bd51cc215916f7d7828e547f Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Thu, 19 Oct 2023 16:23:28 +0200 Subject: [PATCH 2/3] test: add coverage for #29610 As reproducing it is actually pretty easy, with the benefit of hindsight: ~# systemd-run -P -p MountImages="/this/should/definitely/not/exist.img:/run/img2\:3:nosuid" false Running as unit: run-u42.service free(): double free detected in tcache 2 --- test/units/testsuite-50.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/test/units/testsuite-50.sh b/test/units/testsuite-50.sh index 4142e1ebbc..1a379ee061 100755 --- a/test/units/testsuite-50.sh +++ b/test/units/testsuite-50.sh @@ -674,4 +674,11 @@ if command -v mksquashfs >/dev/null 2>&1; then (! test -f /tmp/test-50-confext/etc/waldo ) fi +# Sneak in a couple of expected-to-fail invocations to cover +# https://github.com/systemd/systemd/issues/29610 +(! systemd-run -P -p MountImages="/this/should/definitely/not/exist.img:/run/img2\:3:nosuid" false) +(! systemd-run -P -p ExtensionImages="/this/should/definitely/not/exist.img" false) +(! systemd-run -P -p RootImage="/this/should/definitely/not/exist.img" false) +(! systemd-run -P -p ExtensionDirectories="/foo/bar /foo/baz" false) + touch /testok From d31330c1fa89559079f9ef5a7e91f7c95a1c63ec Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Thu, 19 Oct 2023 16:47:46 +0200 Subject: [PATCH 3/3] core: properly cleanup ExecParameter's prefix array --- src/core/execute.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/core/execute.c b/src/core/execute.c index 46fb8805b3..3f3d92d505 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -2255,7 +2255,13 @@ void exec_params_serialized_done(ExecParameters *p) { p->cgroup_path = mfree(p->cgroup_path); - p->prefix = strv_free(p->prefix); + if (p->prefix) { + for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) + free(p->prefix[t]); + + p->prefix = mfree(p->prefix); + } + p->received_credentials_directory = mfree(p->received_credentials_directory); p->received_encrypted_credentials_directory = mfree(p->received_encrypted_credentials_directory);