From 24ebd6cdbdbd3c616979b1c1aaa770d9ad1e8971 Mon Sep 17 00:00:00 2001 From: Tobias Brick Date: Thu, 3 Sep 2026 20:49:17 +0000 Subject: [PATCH] fix(nbdkit): disable malloc-debug checking Remove glibc malloc-debug checking from the test environment because it splits SymCrypt allocations across libc and malloc-debug. Retain malloc perturbation and the full test suite. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- ...001-tests-disable-glibc-malloc-check.patch | 46 +++++++++++++++++++ ...03-disable-glibc-malloc-check.overlay.toml | 15 ++++++ locks/nbdkit.lock | 2 +- ...001-tests-disable-glibc-malloc-check.patch | 46 +++++++++++++++++++ specs/n/nbdkit/nbdkit.spec | 3 +- 5 files changed, 110 insertions(+), 2 deletions(-) create mode 100644 base/comps/nbdkit/0001-tests-disable-glibc-malloc-check.patch create mode 100644 base/comps/nbdkit/overlays/0003-disable-glibc-malloc-check.overlay.toml create mode 100644 specs/n/nbdkit/0001-tests-disable-glibc-malloc-check.patch diff --git a/base/comps/nbdkit/0001-tests-disable-glibc-malloc-check.patch b/base/comps/nbdkit/0001-tests-disable-glibc-malloc-check.patch new file mode 100644 index 00000000000..bbff8b0a938 --- /dev/null +++ b/base/comps/nbdkit/0001-tests-disable-glibc-malloc-check.patch @@ -0,0 +1,46 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Tobias Brick +Date: Thu, 3 Sep 2026 20:17:00 +0000 +Subject: [PATCH] tests: disable glibc malloc check + +The glibc malloc-debug checker interposes allocation APIs through +libc_malloc_debug.so.0. SymCrypt has unversioned allocator references that +can bind aligned_alloc to libc while binding free to the debug allocator, +causing OpenSSL consumers to abort during provider initialization. + +Keep malloc perturbation enabled with values in glibc's valid 1-255 range +to retain detection of uninitialized and use-after-free behavior without +enabling the incompatible checked allocator. +--- + tests/Makefile.am | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/tests/Makefile.am b/tests/Makefile.am +index 3af137f..cf49212 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -69,18 +69,15 @@ TESTS_ENVIRONMENT = \ + LIBNBD_DEBUG=1 \ + $(NULL) + +-# Enable malloc-check as a cheap way to find some use-after-free and +-# uninitialized read problems when using glibc, and doesn't affect +-# normal operation or other libc. ++# Perturb allocated and freed memory as a cheap way to find some ++# use-after-free and uninitialized read problems. +-random = $(shell bash -c 'echo $$(( 1 + (RANDOM & 255) ))') ++random = $(shell bash -c 'echo $$(( 1 + (RANDOM % 255) ))') + if HAVE_GLIBC_234 + TESTS_ENVIRONMENT += \ +- LD_PRELOAD="$${LD_PRELOAD:+"$$LD_PRELOAD:"}libc_malloc_debug.so.0" \ +- GLIBC_TUNABLES=glibc.malloc.check=1:glibc.malloc.perturb=$(random) \ ++ GLIBC_TUNABLES=glibc.malloc.perturb=$(random) \ + $(NULL) + else + TESTS_ENVIRONMENT += \ +- MALLOC_CHECK_=1 \ + MALLOC_PERTURB_=$(random) \ + $(NULL) + endif +-- +2.55.0 diff --git a/base/comps/nbdkit/overlays/0003-disable-glibc-malloc-check.overlay.toml b/base/comps/nbdkit/overlays/0003-disable-glibc-malloc-check.overlay.toml new file mode 100644 index 00000000000..23e9816872f --- /dev/null +++ b/base/comps/nbdkit/overlays/0003-disable-glibc-malloc-check.overlay.toml @@ -0,0 +1,15 @@ +# SymCrypt's unversioned allocator references can split between libc and +# libc_malloc_debug when glibc's malloc-debug checked allocator is enabled. +# This causes a crash on free() during SymCrypt load. + +[metadata] +category = "azl-temp-workaround" +upstream-status = "unknown" +bugs = [ + { url = "https://dev.azure.com/mariner-org/mariner/_workitems/edit/23389" }, +] + +[[overlays]] +description = "Disable incompatible glibc malloc-debug checking in tests" +type = "patch-add" +source = "../0001-tests-disable-glibc-malloc-check.patch" diff --git a/locks/nbdkit.lock b/locks/nbdkit.lock index 0ff41f18abd..a993852f1d2 100644 --- a/locks/nbdkit.lock +++ b/locks/nbdkit.lock @@ -3,5 +3,5 @@ version = 1 import-commit = 'e033665ff8146ea184d31f82bc22ec3183bc212b' upstream-commit = 'e033665ff8146ea184d31f82bc22ec3183bc212b' manual-bump = 2 -input-fingerprint = 'sha256:667190fddaa6c95a055d3d56d748cc0a73691dffa1b945541c1f742434563f9e' +input-fingerprint = 'sha256:32e17ee018de88e27ea8f74118c5458c1bf63a7b416248580a82bf79b7ee7047' resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e' diff --git a/specs/n/nbdkit/0001-tests-disable-glibc-malloc-check.patch b/specs/n/nbdkit/0001-tests-disable-glibc-malloc-check.patch new file mode 100644 index 00000000000..bbff8b0a938 --- /dev/null +++ b/specs/n/nbdkit/0001-tests-disable-glibc-malloc-check.patch @@ -0,0 +1,46 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Tobias Brick +Date: Thu, 3 Sep 2026 20:17:00 +0000 +Subject: [PATCH] tests: disable glibc malloc check + +The glibc malloc-debug checker interposes allocation APIs through +libc_malloc_debug.so.0. SymCrypt has unversioned allocator references that +can bind aligned_alloc to libc while binding free to the debug allocator, +causing OpenSSL consumers to abort during provider initialization. + +Keep malloc perturbation enabled with values in glibc's valid 1-255 range +to retain detection of uninitialized and use-after-free behavior without +enabling the incompatible checked allocator. +--- + tests/Makefile.am | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/tests/Makefile.am b/tests/Makefile.am +index 3af137f..cf49212 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -69,18 +69,15 @@ TESTS_ENVIRONMENT = \ + LIBNBD_DEBUG=1 \ + $(NULL) + +-# Enable malloc-check as a cheap way to find some use-after-free and +-# uninitialized read problems when using glibc, and doesn't affect +-# normal operation or other libc. ++# Perturb allocated and freed memory as a cheap way to find some ++# use-after-free and uninitialized read problems. +-random = $(shell bash -c 'echo $$(( 1 + (RANDOM & 255) ))') ++random = $(shell bash -c 'echo $$(( 1 + (RANDOM % 255) ))') + if HAVE_GLIBC_234 + TESTS_ENVIRONMENT += \ +- LD_PRELOAD="$${LD_PRELOAD:+"$$LD_PRELOAD:"}libc_malloc_debug.so.0" \ +- GLIBC_TUNABLES=glibc.malloc.check=1:glibc.malloc.perturb=$(random) \ ++ GLIBC_TUNABLES=glibc.malloc.perturb=$(random) \ + $(NULL) + else + TESTS_ENVIRONMENT += \ +- MALLOC_CHECK_=1 \ + MALLOC_PERTURB_=$(random) \ + $(NULL) + endif +-- +2.55.0 diff --git a/specs/n/nbdkit/nbdkit.spec b/specs/n/nbdkit/nbdkit.spec index b9eb14d11be..f1adf781dc6 100644 --- a/specs/n/nbdkit/nbdkit.spec +++ b/specs/n/nbdkit/nbdkit.spec @@ -58,7 +58,7 @@ Name: nbdkit Version: 1.46.2 -Release: 5%{?dist} +Release: 6%{?dist} Summary: NBD server License: BSD-3-Clause @@ -223,6 +223,7 @@ Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) %endif +Patch0: 0001-tests-disable-glibc-malloc-check.patch %description NBD is a protocol for accessing block devices (hard disks and disk-like things) over the network.