threads / patch / 39042

patchgrep: correctly initialize help-all option

Subject: [PATCH] grep: correctly initialize help-all option

## tl;dr

8 messages between Apr 9, 2015 and Apr 11, 2015. Diffs are folded; open one to read it.

replies: 7people: 3as markdown or json

Patrick Steinhardt· Apr 9, 2015, 13:41 UTC · lore
The "help-all" option is being initialized with a wrong value.
While being semantically wrong this can also cause a gcc
segmentation fault on ARMv7 hardfloat platforms with a hardened
toolchain. Fix this by initializing with the correct value.
---
 builtin/grep.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Show changes to builtin/grep.c +1 −1
diff --git a/builtin/grep.c b/builtin/grep.c
index abc4400..c0bf005 100644
--- a/builtin/grep.c
+++ b/builtin/grep.c
@@ -738,7 +738,7 @@ int cmd_grep(int argc, const char **argv, const char *prefix)
 			PARSE_OPT_OPTARG, NULL, (intptr_t)default_pager },
 		OPT_BOOL(0, "ext-grep", &external_grep_allowed__ignored,
 			 N_("allow calling of grep(1) (ignored by this build)")),
-		{ OPTION_CALLBACK, 0, "help-all", &options, NULL, N_("show usage"),
+		{ OPTION_CALLBACK, 0, "help-all", &opt, NULL, N_("show usage"),
 		  PARSE_OPT_HIDDEN | PARSE_OPT_NOARG, help_callback },
 		OPT_END()
 	};
-- 
2.3.5
Eric Sunshine· Apr 9, 2015, 19:45 UTC · re: Patrick Steinhardt · lore

Re: [PATCH] grep: correctly initialize help-all option

On Thu, Apr 9, 2015 at 9:41 AM, Patrick Steinhardt <ps@pks.im> wrote:
> The "help-all" option is being initialized with a wrong value.
> While being semantically wrong this can also cause a gcc
> segmentation fault on ARMv7 hardfloat platforms with a hardened
> toolchain. Fix this by initializing with the correct value.
Missing sign-off.
Show 11 quoted lines
> ---
> diff --git a/builtin/grep.c b/builtin/grep.c
> index abc4400..c0bf005 100644
> --- a/builtin/grep.c
> +++ b/builtin/grep.c
> @@ -738,7 +738,7 @@ int cmd_grep(int argc, const char **argv, const char *prefix)
>                         PARSE_OPT_OPTARG, NULL, (intptr_t)default_pager },
>                 OPT_BOOL(0, "ext-grep", &external_grep_allowed__ignored,
>                          N_("allow calling of grep(1) (ignored by this build)")),
> -               { OPTION_CALLBACK, 0, "help-all", &options, NULL, N_("show usage"),
> +               { OPTION_CALLBACK, 0, "help-all", &opt, NULL, N_("show usage"),
This dates back to 3e230fa1 (grep: use parseopt; 2009-05-07).
builtin/show-ref.c just passes NULL for that argument in the same situation.
Show 5 quoted lines
>                   PARSE_OPT_HIDDEN | PARSE_OPT_NOARG, help_callback },
>                 OPT_END()
>         };
> --
> 2.3.5
Patrick Steinhardt· Apr 9, 2015, 19:59 UTC · re: Patrick Steinhardt · lore

[PATCH v2] grep: correctly initialize help-all option

The "help-all" option is being initialized with a wrong value. While being semantically wrong this can also cause a segmentation fault in gcc on ARMv7 hardfloat platforms with a hardened toolchain. Fix this by initializing with a NULL value.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
---

Added missing sign-off and changed initialization with &opts to initialization with NULL according to Eric's comment as the value is not being used anyway.

 builtin/grep.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Show changes to builtin/grep.c +1 −1
diff --git a/builtin/grep.c b/builtin/grep.c
index abc4400..d04f440 100644
--- a/builtin/grep.c
+++ b/builtin/grep.c
@@ -738,7 +738,7 @@ int cmd_grep(int argc, const char **argv, const char *prefix)
 			PARSE_OPT_OPTARG, NULL, (intptr_t)default_pager },
 		OPT_BOOL(0, "ext-grep", &external_grep_allowed__ignored,
 			 N_("allow calling of grep(1) (ignored by this build)")),
-		{ OPTION_CALLBACK, 0, "help-all", &options, NULL, N_("show usage"),
+		{ OPTION_CALLBACK, 0, "help-all", NULL, NULL, N_("show usage"),
 		  PARSE_OPT_HIDDEN | PARSE_OPT_NOARG, help_callback },
 		OPT_END()
 	};
-- 
2.3.5
René Scharfe· Apr 10, 2015, 16:35 UTC · re: Patrick Steinhardt · lore

Re: [PATCH v2] grep: correctly initialize help-all option

Am 09.04.2015 um 21:59 schrieb Patrick Steinhardt:
> The "help-all" option is being initialized with a wrong value.
> While being semantically wrong this can also cause a segmentation
> fault in gcc on ARMv7 hardfloat platforms with a hardened
> toolchain. Fix this by initializing with a NULL value.

Because the pointer is not used it can't exactly be "wrong". The callback function could call usage_with_options itself using that pointer, for example. I suspect that's what an earlier version did (I don't remember).

Show 6 quoted lines
> Signed-off-by: Patrick Steinhardt <ps@pks.im>
> ---
>
> Added missing sign-off and changed initialization with &opts to
> initialization with NULL according to Eric's comment as the value
> is not being used anyway.
Thanks, it looks good.
Show 18 quoted lines
>
>   builtin/grep.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/builtin/grep.c b/builtin/grep.c
> index abc4400..d04f440 100644
> --- a/builtin/grep.c
> +++ b/builtin/grep.c
> @@ -738,7 +738,7 @@ int cmd_grep(int argc, const char **argv, const char *prefix)
>   			PARSE_OPT_OPTARG, NULL, (intptr_t)default_pager },
>   		OPT_BOOL(0, "ext-grep", &external_grep_allowed__ignored,
>   			 N_("allow calling of grep(1) (ignored by this build)")),
> -		{ OPTION_CALLBACK, 0, "help-all", &options, NULL, N_("show usage"),
> +		{ OPTION_CALLBACK, 0, "help-all", NULL, NULL, N_("show usage"),
>   		  PARSE_OPT_HIDDEN | PARSE_OPT_NOARG, help_callback },
>   		OPT_END()
>   	};
>
René Scharfe· Apr 9, 2015, 21:55 UTC · re: Patrick Steinhardt · lore

Re: [PATCH] grep: correctly initialize help-all option

Am 09.04.2015 um 15:41 schrieb Patrick Steinhardt:
> The "help-all" option is being initialized with a wrong value.
> While being semantically wrong this can also cause a gcc
> segmentation fault on ARMv7 hardfloat platforms with a hardened
> toolchain. Fix this by initializing with the correct value.
Thanks for your report and patch.  A few comments:
Sign-off?  (See "Sign your work" in Documentation/SubmittingPatches)
Show 17 quoted lines
> ---
>   builtin/grep.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/builtin/grep.c b/builtin/grep.c
> index abc4400..c0bf005 100644
> --- a/builtin/grep.c
> +++ b/builtin/grep.c
> @@ -738,7 +738,7 @@ int cmd_grep(int argc, const char **argv, const char *prefix)
>   			PARSE_OPT_OPTARG, NULL, (intptr_t)default_pager },
>   		OPT_BOOL(0, "ext-grep", &external_grep_allowed__ignored,
>   			 N_("allow calling of grep(1) (ignored by this build)")),
> -		{ OPTION_CALLBACK, 0, "help-all", &options, NULL, N_("show usage"),
> +		{ OPTION_CALLBACK, 0, "help-all", &opt, NULL, N_("show usage"),
>   		  PARSE_OPT_HIDDEN | PARSE_OPT_NOARG, help_callback },
>   		OPT_END()
>   	};

help_callback() returns -1 immediately, IOW the value pointer is never used anyway. So why does your change make a difference? *puzzled*

We could pass NULL instead, as in builtin/show-ref.c, which would make it clear that the pointer is just a dummy.

Q: Why does the callback exist in the first place?  A: parse_options() 
handles -h and --help-all automatically by showing the list of available 
options.  This is good for most commands for consistency's sake, but bad 
for commands that want to use -h for something else.  That's why it can 
be turned off with the flag PARSE_OPT_NO_INTERNAL_HELP, but that flag 
disables the long option as well.  It's added back by grep and show-ref 
explicitly, to at least provide --help-all consistently across all commands.

We could solve this problem centrally by checking for -h and --help-all only after looking through the struct option list supplied to parse_options_step() instead of before and getting rid of the then unneeded callbacks for --help-all in grep and show-ref. Are there any downsides to that approach?

René
Patrick Steinhardt· Apr 10, 2015, 05:22 UTC · re: René Scharfe · lore

Re: [PATCH] grep: correctly initialize help-all option

On Thu, Apr 09, 2015 at 11:55:01PM +0200, René Scharfe wrote:
Show 9 quoted lines
> Am 09.04.2015 um 15:41 schrieb Patrick Steinhardt:
> > The "help-all" option is being initialized with a wrong value.
> > While being semantically wrong this can also cause a gcc
> > segmentation fault on ARMv7 hardfloat platforms with a hardened
> > toolchain. Fix this by initializing with the correct value.
> 
> Thanks for your report and patch.  A few comments:
> 
> Sign-off?  (See "Sign your work" in Documentation/SubmittingPatches)
Fixed in v2 of the patch already.
Show 24 quoted lines
> 
> > ---
> >   builtin/grep.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/builtin/grep.c b/builtin/grep.c
> > index abc4400..c0bf005 100644
> > --- a/builtin/grep.c
> > +++ b/builtin/grep.c
> > @@ -738,7 +738,7 @@ int cmd_grep(int argc, const char **argv, const char *prefix)
> >   			PARSE_OPT_OPTARG, NULL, (intptr_t)default_pager },
> >   		OPT_BOOL(0, "ext-grep", &external_grep_allowed__ignored,
> >   			 N_("allow calling of grep(1) (ignored by this build)")),
> > -		{ OPTION_CALLBACK, 0, "help-all", &options, NULL, N_("show usage"),
> > +		{ OPTION_CALLBACK, 0, "help-all", &opt, NULL, N_("show usage"),
> >   		  PARSE_OPT_HIDDEN | PARSE_OPT_NOARG, help_callback },
> >   		OPT_END()
> >   	};
> 
> help_callback() returns -1 immediately, IOW the value pointer is never 
> used anyway.  So why does your change make a difference?  *puzzled*
> 
> We could pass NULL instead, as in builtin/show-ref.c, which would make 
> it clear that the pointer is just a dummy.
Changed in v2, as well.

In general the change won't make any difference when running the command. But as said in the commit message it caused gcc (gcc version 4.8.3 (Gentoo Hardened 4.8.3 p1.1, pie-0.5.9), ARMv7 HF) to segfault when &options was passed in as value. Even though this is probably an error in gcc we can easily work around it by doing the Right Thing here.

Show 13 quoted lines
> Q: Why does the callback exist in the first place?  A: parse_options() 
> handles -h and --help-all automatically by showing the list of available 
> options.  This is good for most commands for consistency's sake, but bad 
> for commands that want to use -h for something else.  That's why it can 
> be turned off with the flag PARSE_OPT_NO_INTERNAL_HELP, but that flag 
> disables the long option as well.  It's added back by grep and show-ref 
> explicitly, to at least provide --help-all consistently across all commands.
> 
> We could solve this problem centrally by checking for -h and --help-all 
> only after looking through the struct option list supplied to 
> parse_options_step() instead of before and getting rid of the then 
> unneeded callbacks for --help-all in grep and show-ref.  Are there any 
> downsides to that approach?

I'll leave that question to the folks more experienced with the code base.

> René
Thanks for your feedback.
Patrick
René Scharfe· Apr 10, 2015, 16:34 UTC · re: Patrick Steinhardt · lore

Re: [PATCH] grep: correctly initialize help-all option

Am 10.04.2015 um 07:22 schrieb Patrick Steinhardt:
Show 27 quoted lines
> On Thu, Apr 09, 2015 at 11:55:01PM +0200, René Scharfe wrote:
>> Am 09.04.2015 um 15:41 schrieb Patrick Steinhardt:
>>> ---
>>>    builtin/grep.c | 2 +-
>>>    1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/builtin/grep.c b/builtin/grep.c
>>> index abc4400..c0bf005 100644
>>> --- a/builtin/grep.c
>>> +++ b/builtin/grep.c
>>> @@ -738,7 +738,7 @@ int cmd_grep(int argc, const char **argv, const char *prefix)
>>>    			PARSE_OPT_OPTARG, NULL, (intptr_t)default_pager },
>>>    		OPT_BOOL(0, "ext-grep", &external_grep_allowed__ignored,
>>>    			 N_("allow calling of grep(1) (ignored by this build)")),
>>> -		{ OPTION_CALLBACK, 0, "help-all", &options, NULL, N_("show usage"),
>>> +		{ OPTION_CALLBACK, 0, "help-all", &opt, NULL, N_("show usage"),
>>>    		  PARSE_OPT_HIDDEN | PARSE_OPT_NOARG, help_callback },
>>>    		OPT_END()
>>>    	};
>>
>> help_callback() returns -1 immediately, IOW the value pointer is never
>> used anyway.  So why does your change make a difference?  *puzzled*
>>
>> We could pass NULL instead, as in builtin/show-ref.c, which would make
>> it clear that the pointer is just a dummy.
>
> Changed in v2, as well.

Thank you. I should really re-fetch from Gmane before finishing an interrupted reply..

Show 6 quoted lines
> In general the change won't make any difference when running the
> command. But as said in the commit message it caused gcc (gcc
> version 4.8.3 (Gentoo Hardened 4.8.3 p1.1, pie-0.5.9), ARMv7 HF)
> to segfault when &options was passed in as value. Even though
> this is probably an error in gcc we can easily work around it by
> doing the Right Thing here.
OK, so does it crash on this one-liner as well?
	struct t {void *p;} s = {&s};
Or on this?
	void *p = &p;

If yes then the author of the hardening feature might be interested in this fact.

René
Patrick Steinhardt· Apr 11, 2015, 00:34 UTC · re: René Scharfe · lore

Re: [PATCH] grep: correctly initialize help-all option

On Fri, Apr 10, 2015 at 06:34:29PM +0200, René Scharfe wrote:
Show 51 quoted lines
> Am 10.04.2015 um 07:22 schrieb Patrick Steinhardt:
> > On Thu, Apr 09, 2015 at 11:55:01PM +0200, René Scharfe wrote:
> >> Am 09.04.2015 um 15:41 schrieb Patrick Steinhardt:
> >>> ---
> >>>    builtin/grep.c | 2 +-
> >>>    1 file changed, 1 insertion(+), 1 deletion(-)
> >>>
> >>> diff --git a/builtin/grep.c b/builtin/grep.c
> >>> index abc4400..c0bf005 100644
> >>> --- a/builtin/grep.c
> >>> +++ b/builtin/grep.c
> >>> @@ -738,7 +738,7 @@ int cmd_grep(int argc, const char **argv, const char *prefix)
> >>>    			PARSE_OPT_OPTARG, NULL, (intptr_t)default_pager },
> >>>    		OPT_BOOL(0, "ext-grep", &external_grep_allowed__ignored,
> >>>    			 N_("allow calling of grep(1) (ignored by this build)")),
> >>> -		{ OPTION_CALLBACK, 0, "help-all", &options, NULL, N_("show usage"),
> >>> +		{ OPTION_CALLBACK, 0, "help-all", &opt, NULL, N_("show usage"),
> >>>    		  PARSE_OPT_HIDDEN | PARSE_OPT_NOARG, help_callback },
> >>>    		OPT_END()
> >>>    	};
> >>
> >> help_callback() returns -1 immediately, IOW the value pointer is never
> >> used anyway.  So why does your change make a difference?  *puzzled*
> >>
> >> We could pass NULL instead, as in builtin/show-ref.c, which would make
> >> it clear that the pointer is just a dummy.
> >
> > Changed in v2, as well.
> 
> Thank you.  I should really re-fetch from Gmane before finishing an 
> interrupted reply..
> 
> > In general the change won't make any difference when running the
> > command. But as said in the commit message it caused gcc (gcc
> > version 4.8.3 (Gentoo Hardened 4.8.3 p1.1, pie-0.5.9), ARMv7 HF)
> > to segfault when &options was passed in as value. Even though
> > this is probably an error in gcc we can easily work around it by
> > doing the Right Thing here.
> 
> OK, so does it crash on this one-liner as well?
> 
> 	struct t {void *p;} s = {&s};
> 
> Or on this?
> 
> 	void *p = &p;
> 
> If yes then the author of the hardening feature might be interested in 
> this fact.
> 
> René

No, the segfault is not triggered by this. I've also tried to use the exact arguments to gcc that are used when compiling grep.c, but to no avail. I'll maybe try to reproduce this with a minimal testcase next week.

Regards Patrick

← back to recent threads