What type of defect/bug is this?
Crash or memory corruption (segv, abort, etc...)
How can the issue be reproduced?
As mentioned in FreeRADIUS/pam_radius#24, FreeRADIUS has a similar problem, because the use of fd in select is restricted. My test found that when my rest custom configuration such as rest_authorize_mac, rest_acct_start_portaluser, Rest_acct_stop_portaluser (http callback of six users freeradius to my own portal-server) When http_pool max=1024 is set, the freeradius program will crash, prompting buffer overflow detected, SIGABRT, Through ai analysis, it is as follows: the use of select () in sql will limit the fd of 1024, which will lead to the program crashing out of FD _ set (1551, & read _ FD) ← ── 1551 > 1023, which can't be installed. FD_SETSIZE = 1024 was written in the system header file at compile time, and it has nothing to do with ulimit -n n. Ulmit-n controls how many fds a process can open, but does not change the size of fd_set bitmap. ai prompts that rlm_sql_postgresql.c:334-367 can be modified, and select()+FD_SET can be changed to poll (). I don't know if this is feasible, but I hope freeradius can be more efficient.
Log output from the FreeRADIUS daemon
docker logs freeradius:
*** buffer overflow detected ***: radiusd terminated
Relevant log output from client utilities
No response
Backtrace from LLDB or GDB
(gdb) continue
Continuing.
[Thread 0xfffff376efa0 (LWP 4183) exited]
[New Thread 0xfffff376efa0 (LWP 5209)]
[New Thread 0xfffdf7ffefa0 (LWP 5210)]
[New Thread 0xfffdf77eefa0 (LWP 5211)]
[New Thread 0xfffdf6fdefa0 (LWP 5212)]
[New Thread 0xfffdf67cefa0 (LWP 5213)]
[New Thread 0xfffdf5fbefa0 (LWP 5214)]
[New Thread 0xfffdf57aefa0 (LWP 5215)]
[New Thread 0xfffdf4f9efa0 (LWP 5216)]
[New Thread 0xfffcffffefa0 (LWP 5217)]
[New Thread 0xfffcff7eefa0 (LWP 5218)]
[New Thread 0xfffcfefdefa0 (LWP 5219)]
[New Thread 0xfffcfe7cefa0 (LWP 5220)]
[New Thread 0xfffcfdfbefa0 (LWP 5221)]
[New Thread 0xfffcfd7aefa0 (LWP 5222)]
[New Thread 0xfffcfcf9efa0 (LWP 5223)]
[New Thread 0xfffcf7ffefa0 (LWP 5224)]
[New Thread 0xfffcf77eefa0 (LWP 5225)]
[New Thread 0xfffcf6fdefa0 (LWP 5226)]
[New Thread 0xfffcf67cefa0 (LWP 5227)]
[New Thread 0xfffcf5fbefa0 (LWP 5228)]
[New Thread 0xfffcf57aefa0 (LWP 5229)]
[New Thread 0xfffcf4f9efa0 (LWP 5230)]
[New Thread 0xfffcf478efa0 (LWP 5231)]
[New Thread 0xfffcf3f7efa0 (LWP 5232)]
[New Thread 0xfffcf376efa0 (LWP 5233)]
[New Thread 0xfffff3f7efa0 (LWP 5234)]
[Thread 0xfffff3f7efa0 (LWP 4182) exited]
*** buffer overflow detected ***: /usr/sbin/radiusd terminated
*** buffer overflow detected ***: /usr/sbin/radiusd terminated
*** buffer overflow detected ***: /usr/sbin/radiusd terminated
*** buffer overflow detected ***: /usr/sbin/radiusd terminated
*** buffer overflow detected ***: /usr/sbin/radiusd terminated
*** buffer overflow detected ***: /usr/sbin/radiusd terminated
*** buffer overflow detected ***: /usr/sbin/radiusd terminated
*** buffer overflow detected ***: /usr/sbin/radiusd terminated
*** buffer overflow detected ***: /usr/sbin/radiusd terminated
*** buffer overflow detected ***: /usr/sbin/radiusd terminated
*** buffer overflow detected ***: /usr/sbin/radiusd terminated
*** buffer overflow detected ***: /usr/sbin/radiusd terminated
*** buffer overflow detected ***: /usr/sbin/radiusd terminated
*** buffer overflow detected ***: /usr/sbin/radiusd terminated
Thread 60 "radiusd" received signal SIGABRT, Aborted.
[Switching to Thread 0xffffd6bdefa0 (LWP 4240)]
0x0000fffff76b6274 in raise () from /lib64/libc.so.6
(gdb) bt full
#0 0x0000fffff76b6274 in raise () from /lib64/libc.so.6
No symbol table info available.
#1 0x0000fffff76a0a2c in abort () from /lib64/libc.so.6
No symbol table info available.
#2 0x0000fffff76efb08 in __libc_message () from /lib64/libc.so.6
No symbol table info available.
#3 0x0000fffff776395c in __fortify_fail_abort () from /lib64/libc.so.6
No symbol table info available.
#4 0x0000fffff7763994 in __fortify_fail () from /lib64/libc.so.6
No symbol table info available.
#5 0x0000fffff77616a4 in __chk_fail () from /lib64/libc.so.6
No symbol table info available.
#6 0x0000fffff776389c in __fdelt_warn () from /lib64/libc.so.6
No symbol table info available.
#7 0x0000fffff66940d4 in sql_query (handle=<optimized out>, config=0x7abad0, query=<optimized out>) at src/modules/rlm_sql/drivers/rlm_sql_postgresql/rlm_sql_postgresql.c:340
__d = 1551
read_fd = {fds_bits = {0 <repeats 16 times>}}
when = {tv_sec = 281474841393632, tv_usec = 281474842426248}
wake = {tv_sec = 281474284510048, tv_usec = 281474284510048}
r = <optimized out>
elapsed = {tv_sec = 281474837381168, tv_usec = 403047957}
conn = 0xfffd04047a50
start = {tv_sec = 1782895725, tv_usec = 167886}
sockfd = 1551
status = <optimized out>
numfields = 0
tmp_result = <optimized out>
#8 0x0000fffff66c63a0 in rlm_sql_query (inst=inst@entry=0x7abad0, request=request@entry=0x281b400, handle=handle@entry=0xffffd6bddca8,
query=0xfffd0413ac40 "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctUpdateTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start,"...) at src/modules/rlm_sql/sql.c:304
ret = <optimized out>
i = 0
count = <optimized out>
#9 0x0000fffff66c3188 in acct_redundant (inst=0x7abad0, request=0x281b400, section=0x7abbc8) at src/modules/rlm_sql/rlm_sql.c:1477
rcode = RLM_MODULE_OK
handle = 0xfffd04047690
sql_ret = <optimized out>
numaffected = <optimized out>
item = <optimized out>
pair = 0x6f86a0
attr = 0x6f8750 "query"
--Type <RET> for more, q to quit, c to continue without paging--
What type of defect/bug is this?
Crash or memory corruption (segv, abort, etc...)
How can the issue be reproduced?
As mentioned in FreeRADIUS/pam_radius#24, FreeRADIUS has a similar problem, because the use of fd in select is restricted. My test found that when my rest custom configuration such as rest_authorize_mac, rest_acct_start_portaluser, Rest_acct_stop_portaluser (http callback of six users freeradius to my own portal-server) When http_pool max=1024 is set, the freeradius program will crash, prompting buffer overflow detected, SIGABRT, Through ai analysis, it is as follows: the use of select () in sql will limit the fd of 1024, which will lead to the program crashing out of FD _ set (1551, & read _ FD) ← ── 1551 > 1023, which can't be installed. FD_SETSIZE = 1024 was written in the system header file at compile time, and it has nothing to do with ulimit -n n. Ulmit-n controls how many fds a process can open, but does not change the size of fd_set bitmap. ai prompts that rlm_sql_postgresql.c:334-367 can be modified, and select()+FD_SET can be changed to poll (). I don't know if this is feasible, but I hope freeradius can be more efficient.
Log output from the FreeRADIUS daemon
Relevant log output from client utilities
No response
Backtrace from LLDB or GDB