[libvirt] [PATCH] log: fix deadlock obtaining hostname (related CVE-2018-6764)

[Michal Privoznik]

On 02/12/2018 11:08 AM, Daniel P. Berrangé wrote:
> The fix for CVE-2018-6764 introduced a potential deadlock scenario
> that gets triggered by the NSS module when virGetHostname() calls
> getaddrinfo to resolve the hostname:
> 
>  #0  0x00007f6e714b57e7 in futex_wait
>  #1  futex_wait_simple
>  #2  __pthread_once_slow
>  #3  0x00007f6e71d16e7d in virOnce
>  #4  0x00007f6e71d0997c in virLogInitialize
>  #5  0x00007f6e71d0a09a in virLogVMessage
>  #6  0x00007f6e71d09ffd in virLogMessage
>  #7  0x00007f6e71d0db22 in virObjectNew
>  #8  0x00007f6e71d0dbf1 in virObjectLockableNew
>  #9  0x00007f6e71d0d3e5 in virMacMapNew
>  #10 0x00007f6e71cdc50a in findLease
>  #11 0x00007f6e71cdcc56 in _nss_libvirt_gethostbyname4_r
>  #12 0x00007f6e724631fc in gaih_inet
>  #13 0x00007f6e72464697 in __GI_getaddrinfo
>  #14 0x00007f6e71d19e81 in virGetHostnameImpl
>  #15 0x00007f6e71d1a057 in virGetHostnameQuiet
>  #16 0x00007f6e71d09936 in virLogOnceInit
>  #17 0x00007f6e71d09952 in virLogOnce
>  #18 0x00007f6e714b5829 in __pthread_once_slow
>  #19 0x00007f6e71d16e7d in virOnce
>  #20 0x00007f6e71d0997c in virLogInitialize
>  #21 0x00007f6e71d0a09a in virLogVMessage
>  #22 0x00007f6e71d09ffd in virLogMessage
>  #23 0x00007f6e71d0db22 in virObjectNew
>  #24 0x00007f6e71d0dbf1 in virObjectLockableNew
>  #25 0x00007f6e71d0d3e5 in virMacMapNew
>  #26 0x00007f6e71cdc50a in findLease
>  #27 0x00007f6e71cdc839 in _nss_libvirt_gethostbyname3_r
>  #28 0x00007f6e71cdc724 in _nss_libvirt_gethostbyname2_r
>  #29 0x00007f6e7248f72f in __gethostbyname2_r
>  #30 0x00007f6e7248f494 in gethostbyname2
>  #31 0x000056348c30c36d in hosts_keys
>  #32 0x000056348c30b7d2 in main
> 
> Fortunately the extra stuff virGetHostname does is totally irrelevant to
> the needs of the logging code, so we can just inline a call to the
> native hostname() syscall directly.
> 
> Signed-off-by: Daniel P. Berrangé <berrange at redhat.com>
> ---
>  src/util/virlog.c | 20 ++++++++++++++------
>  1 file changed, 14 insertions(+), 6 deletions(-)

ACK

Michal