numad

#7 Fedora 38 : buffer overflow detected
Opened by dst. Modified

Open
Close Issue 
[root@fedora ~]# strace numad
execve("/usr/bin/numad", ["numad"], 0x7ffe5a1ffd10 /* 22 vars */) = 0
brk(NULL)                               = 0x55d1f5c45000
arch_prctl(0x3001 /* ARCH_??? */, 0x7fff26156040) = -1 EINVAL (Invalid argument)
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=59383, ...}, AT_EMPTY_PATH) = 0
mmap(NULL, 59383, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f948a7e5000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libm.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
newfstatat(3, "", {st_mode=S_IFREG|0755, st_size=931552, ...}, AT_EMPTY_PATH) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f948a7e3000
mmap(NULL, 917752, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f948a702000
mmap(0x7f948a712000, 479232, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x10000) = 0x7f948a712000
mmap(0x7f948a787000, 368640, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x85000) = 0x7f948a787000
mmap(0x7f948a7e1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xde000) = 0x7f948a7e1000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 }\2\0\0\0\0\0"..., 832) = 832
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
newfstatat(3, "", {st_mode=S_IFREG|0755, st_size=2234072, ...}, AT_EMPTY_PATH) = 0
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
mmap(NULL, 1957168, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f948a524000
mmap(0x7f948a54a000, 1429504, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x26000) = 0x7f948a54a000
mmap(0x7f948a6a7000, 315392, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x183000) = 0x7f948a6a7000
mmap(0x7f948a6f4000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1d0000) = 0x7f948a6f4000
mmap(0x7f948a6fa000, 32048, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f948a6fa000
close(3)                                = 0
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f948a521000
arch_prctl(ARCH_SET_FS, 0x7f948a521740) = 0
set_tid_address(0x7f948a521a10)         = 21947
set_robust_list(0x7f948a521a20, 24)     = 0
rseq(0x7f948a522060, 0x20, 0, 0x53053053) = 0
mprotect(0x7f948a6f4000, 16384, PROT_READ) = 0
mprotect(0x7f948a7e1000, 4096, PROT_READ) = 0
mprotect(0x55d1f4e31000, 4096, PROT_READ) = 0
mprotect(0x7f948a825000, 8192, PROT_READ) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
munmap(0x7f948a7e5000, 59383)           = 0
getrandom("\x56\xb2\x7b\x1a\x49\x09\x4d\xca", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55d1f5c45000
brk(0x55d1f5c66000)                     = 0x55d1f5c66000
openat(AT_FDCWD, "/var/log/numad.log", O_WRONLY|O_CREAT|O_APPEND, 0666) = 3
lseek(3, 0, SEEK_END)                   = 39675
msgget(0xdeadbeef, IPC_CREAT|0660)      = 0
msgrcv(0, 0x7fff26154c30, 128, 0, IPC_NOWAIT) = -1 ENOMSG (No message of desired type)
openat(AT_FDCWD, "/sys/devices/system/cpu/possible", O_RDONLY|O_CLOEXEC) = 4
read(4, "0-15\n", 1024)                 = 5
close(4)                                = 0
openat(AT_FDCWD, "/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = 4
read(4, "0-15\n", 1024)                 = 5
close(4)                                = 0
openat(AT_FDCWD, "/proc/meminfo", O_RDONLY) = 4
newfstatat(4, "", {st_mode=S_IFREG|0444, st_size=0, ...}, AT_EMPTY_PATH) = 0
read(4, "MemTotal:       65550224 kB\nMemF"..., 1024) = 1024
read(4, "     171492 kB\nVmallocChunk:    "..., 1024) = 535
close(4)                                = 0
openat(AT_FDCWD, "/var/run/numad.pid", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/sys/kernel/mm/transparent_hugepage/khugepaged/scan_sleep_millisecs", O_RDWR) = 4
read(4, "10000\n", 1024)                = 6
lseek(4, 0, SEEK_SET)                   = 0
openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 5
newfstatat(5, "", {st_mode=S_IFREG|0644, st_size=2332, ...}, AT_EMPTY_PATH) = 0
newfstatat(5, "", {st_mode=S_IFREG|0644, st_size=2332, ...}, AT_EMPTY_PATH) = 0
read(5, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0"..., 4096) = 2332
lseek(5, -1478, SEEK_CUR)               = 854
read(5, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0"..., 4096) = 1478
close(5)                                = 0
writev(2, [{iov_base="*** ", iov_len=4}, {iov_base="buffer overflow detected", iov_len=24}, {iov_base=" ***: terminated\n", iov_len=17}], 3*** buffer overflow detected ***: terminated
) = 45
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f948a7f3000
rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
gettid()                                = 21947
getpid()                                = 21947
tgkill(21947, 21947, SIGABRT)           = 0
--- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=21947, si_uid=0} ---
+++ killed by SIGABRT (core dumped) +++
Aborted (core dumped)

I cannot replicate the behavior when I build the project on an up to date Fedora 38. @jsynacek can you force a new build ?

Thank you

CC @lnykryn @sgallagh

I see you've recently submitted build requests, can one of you trigger a new build for Fedora 38 ?

Thank you.

Side Note: RH Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2210474

https://koji.fedoraproject.org/koji/taskinfo?taskID=105773947

Thank you Lukáš. Unfortunately it did not solve the issue.

After installing the package in a test system :

dnf install https://kojipkgs.fedoraproject.org//packages/numad/0.5/39.20150602git.fc38/x86_64/numad-0.5-39.20150602git.fc38.x86_64.rpm
[root@localhost ~]# dnf info numad
Last metadata expiration check: 0:13:35 ago on Tue 05 Sep 2023 07:35:39 AM MDT.
Installed Packages
Name         : numad
Version      : 0.5
Release      : 39.20150602git.fc38
Architecture : x86_64
Size         : 60 k
Source       : numad-0.5-39.20150602git.fc38.src.rpm
Repository   : @System
From repo    : @commandline
Summary      : NUMA user daemon
URL          : https://pagure.io/numad
License      : LGPLv2
Description  : Numad, a daemon for NUMA (Non-Uniform Memory Architecture) systems,
             : that monitors NUMA characteristics and manages placement of processes
             : and memory to minimize memory latency and thus provide optimum performance.

I still get the error when starting the process:

Sep 05 07:45:47 localhost.localdomain systemd-coredump[30826]: [🡕] Process 30824 (numad) of user 0 dumped core.
                                                             Module numad from rpm numad-0.5-39.20150602git.fc38.x86_64
                                                             Stack trace of thread 30824:
                                                             #0  0x00007f7c734e0844 __pthread_kill_implementation (libc.so.6 + 0x8e844)
                                                             #1  0x00007f7c7348fabe raise (libc.so.6 + 0x3dabe)
                                                             #2  0x00007f7c7347887f abort (libc.so.6 + 0x2687f)
                                                             #3  0x00007f7c7347960f __libc_message.cold (libc.so.6 + 0x2760f)
                                                             #4  0x00007f7c73574979 __fortify_fail (libc.so.6 + 0x122979)
                                                             #5  0x00007f7c735731b4 __chk_fail (libc.so.6 + 0x1211b4)
                                                             #6  0x00007f7c73572dd1 __vsnprintf_chk (libc.so.6 + 0x120dd1)
                                                             #7  0x000055ee15bc0071 numad_log (numad + 0x5071)
                                                             #8  0x000055ee15bc3d78 set_thp_scan_sleep_ms.part.0 (numad + 0x8d78)
                                                             #9  0x000055ee15bbe23d main (numad + 0x323d)
                                                             #10 0x00007f7c73479b4a __libc_start_call_main (libc.so.6 + 0x27b4a)
                                                             #11 0x00007f7c73479c0b __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x27c0b)
                                                             #12 0x000055ee15bbfe25 _start (numad + 0x4e25)
                                                             ELF object binary architecture: AMD x86-64

And strace output the same stack:

[root@localhost ~]# strace numad
execve("/usr/bin/numad", ["numad"], 0x7ffd9ff27d50 /* 22 vars */) = 0
brk(NULL)                               = 0x55e52fe16000
arch_prctl(0x3001 /* ARCH_??? */, 0x7ffeeb6e5990) = -1 EINVAL (Invalid argument)
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=59467, ...}, AT_EMPTY_PATH) = 0
mmap(NULL, 59467, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f01c5878000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libm.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
newfstatat(3, "", {st_mode=S_IFREG|0755, st_size=931552, ...}, AT_EMPTY_PATH) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f01c5876000
mmap(NULL, 917752, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f01c5795000
mmap(0x7f01c57a5000, 479232, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x10000) = 0x7f01c57a5000
mmap(0x7f01c581a000, 368640, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x85000) = 0x7f01c581a000
mmap(0x7f01c5874000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xde000) = 0x7f01c5874000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 }\2\0\0\0\0\0"..., 832) = 832
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
newfstatat(3, "", {st_mode=S_IFREG|0755, st_size=2234072, ...}, AT_EMPTY_PATH) = 0
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
mmap(NULL, 1957168, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f01c55b7000
mmap(0x7f01c55dd000, 1429504, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x26000) = 0x7f01c55dd000
mmap(0x7f01c573a000, 315392, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x183000) = 0x7f01c573a000
mmap(0x7f01c5787000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1d0000) = 0x7f01c5787000
mmap(0x7f01c578d000, 32048, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f01c578d000
close(3)                                = 0
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f01c55b4000
arch_prctl(ARCH_SET_FS, 0x7f01c55b4740) = 0
set_tid_address(0x7f01c55b4a10)         = 30866
set_robust_list(0x7f01c55b4a20, 24)     = 0
rseq(0x7f01c55b5060, 0x20, 0, 0x53053053) = 0
mprotect(0x7f01c5787000, 16384, PROT_READ) = 0
mprotect(0x7f01c5874000, 4096, PROT_READ) = 0
mprotect(0x55e52fca4000, 4096, PROT_READ) = 0
mprotect(0x7f01c58b8000, 8192, PROT_READ) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
munmap(0x7f01c5878000, 59467)           = 0
getrandom("\xc7\xcb\x30\x63\xbb\x44\x13\x50", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55e52fe16000
brk(0x55e52fe37000)                     = 0x55e52fe37000
openat(AT_FDCWD, "/var/log/numad.log", O_WRONLY|O_CREAT|O_APPEND, 0666) = 3
lseek(3, 0, SEEK_END)                   = 0
msgget(0xdeadbeef, IPC_CREAT|0660)      = 0
msgrcv(0, 0x7ffeeb6e4580, 128, 0, IPC_NOWAIT) = -1 ENOMSG (No message of desired type)
openat(AT_FDCWD, "/sys/devices/system/cpu/possible", O_RDONLY|O_CLOEXEC) = 4
read(4, "0-15\n", 1024)                 = 5
close(4)                                = 0
openat(AT_FDCWD, "/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = 4
read(4, "0-15\n", 1024)                 = 5
close(4)                                = 0
openat(AT_FDCWD, "/proc/meminfo", O_RDONLY) = 4
newfstatat(4, "", {st_mode=S_IFREG|0444, st_size=0, ...}, AT_EMPTY_PATH) = 0
read(4, "MemTotal:       65550224 kB\nMemF"..., 1024) = 1024
read(4, "     176068 kB\nVmallocChunk:    "..., 1024) = 535
close(4)                                = 0
openat(AT_FDCWD, "/var/run/numad.pid", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/sys/kernel/mm/transparent_hugepage/khugepaged/scan_sleep_millisecs", O_RDWR) = 4
read(4, "10000\n", 1024)                = 6
lseek(4, 0, SEEK_SET)                   = 0
openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 5
newfstatat(5, "", {st_mode=S_IFREG|0644, st_size=2332, ...}, AT_EMPTY_PATH) = 0
newfstatat(5, "", {st_mode=S_IFREG|0644, st_size=2332, ...}, AT_EMPTY_PATH) = 0
read(5, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0"..., 4096) = 2332
lseek(5, -1478, SEEK_CUR)               = 854
read(5, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0"..., 4096) = 1478
close(5)                                = 0
writev(2, [{iov_base="*** ", iov_len=4}, {iov_base="buffer overflow detected", iov_len=24}, {iov_base=" ***: terminated\n", iov_len=17}], 3*** buffer overflow detected ***: terminated
) = 45
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f01c5886000
rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
gettid()                                = 30866
getpid()                                = 30866
tgkill(30866, 30866, SIGABRT)           = 0
--- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=30866, si_uid=0} ---
+++ killed by SIGABRT (core dumped) +++
Aborted (core dumped)

What difference between my environment and Koji build system could trigger such behavior ?

When I build numad on this system by opening KDevelop and hitting the build button it does not crash.

Thanks in advance for looking further into this.

I am fairly certain this is a real bug in numad that surfaced after https://fedoraproject.org/wiki/Changes/Add_FORTIFY_SOURCE%3D3_to_distribution_build_flags

Can you try this:

https://bodhi.fedoraproject.org/updates/FEDORA-2023-4ebdc3f086

Hello Lukáš, I've just tested the new package and, good news, it's now working again:

[root@localhost ~]# systemctl status numad
● numad.service - numad - The NUMA daemon that manages application locality.
     Loaded: loaded (/usr/lib/systemd/system/numad.service; enabled; preset: disabled)
    Drop-In: /usr/lib/systemd/system/service.d
             └─10-timeout-abort.conf
     Active: active (running) since Wed 2023-09-06 07:29:03 MDT; 10s ago
       Docs: man:numad
   Main PID: 50964 (numad)
      Tasks: 2 (limit: 76764)
     Memory: 292.0K
        CPU: 1ms
     CGroup: /system.slice/numad.service
             └─50964 /usr/bin/numad -i 15
Sep 06 07:29:03 localhost.localdomain systemd[1]: Starting numad.service - numad - The NUMA daemon that manages application locality....
Sep 06 07:29:03 localhost.localdomain systemd[1]: Started numad.service - numad - The NUMA daemon that manages application locality..
root@localhost ~]# dnf info numad
Last metadata expiration check: 1:34:27 ago on Wed 06 Sep 2023 05:56:39 AM MDT.
Installed Packages
Name         : numad
Version      : 0.5
Release      : 40.20150602git.fc38
Architecture : x86_64
Size         : 60 k
Source       : numad-0.5-40.20150602git.fc38.src.rpm
Repository   : @System
From repo    : @commandline
Summary      : NUMA user daemon
URL          : https://pagure.io/numad
License      : LGPL-2.1-only
Description  : Numad, a daemon for NUMA (Non-Uniform Memory Architecture) systems,
             : that monitors NUMA characteristics and manages placement of processes
             : and memory to minimize memory latency and thus provide optimum performance.

Let me know if there's anything else I should test and a big thank you for the quick turnaround.
Edited by dst
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.