Bug 64746 - our_ftok() can produce SHM ids with low order bits all zero
Summary: our_ftok() can produce SHM ids with low order bits all zero
Status: NEW
Alias: None
Product: APR
Classification: Unclassified
Component: APR (show other bugs)
Version: HEAD
Hardware: PC other
: P2 normal (vote)
Target Milestone: ---
Assignee: Apache Portable Runtime bugs mailinglist
URL:
Keywords: PatchAvailable
Depends on:
Blocks:
 
Reported: 2020-09-17 12:46 UTC by Eric Covener
Modified: 2020-09-21 07:04 UTC (History)
0 users



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Eric Covener 2020-09-17 12:46:27 UTC
posix says:

Only the low-order 8-bits of id are significant. The behavior of ftok() is unspecified if these bits are 0.

#if APR_USE_SHMEM_SHMGET
static key_t our_ftok(const char *filename)
{
    /* to help avoid collisions while still using
     * an easily recreated proj_id */
    apr_ssize_t slen = strlen(filename);
    return ftok(filename,
                (int)apr_hashfunc_default(filename, &slen));
}
#endif


If you get unlucky the default hash function can return values that hit the unspecified case, on my nightly test system this happens occasionally based on the parent pid of of httpd, here is an unlucky one: /tmp/httpd_lua_shm.66808

Which hashes to 1477165056
0b1011000000010111100000000000000

Would even a minor change to our_ftok() require a release boundary to be changeable when APR is not embedded?
Comment 1 Joe Orton 2020-09-17 13:42:21 UTC
We changed from plain ftok() to our_ftok() in 1.5 so should be fine to fudge it IMO.  Is there any platform where ftok actually misbehaves when passed 0?  IIRC most implementations simply XOR the inode number with the project ID
Comment 2 Eric Covener 2020-09-17 13:46:40 UTC
This was changed from a constant to a hash across the filename because the bug below that points to NOTES in the linux/glibc manual that says separate filenames with the same low 16bits in the inode can collide too.

https://bz.apache.org/bugzilla/show_bug.cgi?id=53996


Collided with Joe:

Yes, we see it fail w/ EINVAL on z/OS.
Comment 3 Eric Covener 2020-09-18 19:24:52 UTC
fall back to 1 if the ID looks suspicious?

http://people.apache.org/~covener/patches/pr64746.diff
Comment 4 Joe Orton 2020-09-21 07:04:22 UTC
+1 from me