From 0991897f0c34afa66059c9eaa547dba9d232fe5f Mon Sep 17 00:00:00 2001 From: Tobias Brick Date: Fri, 4 Sep 2026 18:56:18 +0000 Subject: [PATCH] fix(guestfs-tools): disable legacy malloc checking Remove the checked allocator because it splits SymCrypt allocations across libc and malloc-debug. Retain malloc perturbation and the full test suite, and classify the overlay as an AZL-only workaround. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- ...002-tests-disable-glibc-malloc-check.patch | 42 +++++++++++++++++++ .../guestfs-tools/guestfs-tools.comp.toml | 10 +++++ locks/guestfs-tools.lock | 2 +- ...002-tests-disable-glibc-malloc-check.patch | 42 +++++++++++++++++++ specs/g/guestfs-tools/guestfs-tools.spec | 3 +- 5 files changed, 97 insertions(+), 2 deletions(-) create mode 100644 base/comps/guestfs-tools/0002-tests-disable-glibc-malloc-check.patch create mode 100644 specs/g/guestfs-tools/0002-tests-disable-glibc-malloc-check.patch diff --git a/base/comps/guestfs-tools/0002-tests-disable-glibc-malloc-check.patch b/base/comps/guestfs-tools/0002-tests-disable-glibc-malloc-check.patch new file mode 100644 index 00000000000..4625bf9f1b4 --- /dev/null +++ b/base/comps/guestfs-tools/0002-tests-disable-glibc-malloc-check.patch @@ -0,0 +1,42 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Tobias Brick +Date: Fri, 4 Sep 2026 15:36:00 +0000 +Subject: [PATCH] tests: disable glibc malloc check + +The legacy glibc malloc checker interposes allocation APIs through +libc_malloc_debug.so.0. SymCrypt has unversioned allocator references that +can bind aligned_alloc to libc while binding free to the debug allocator, +causing OpenSSL consumers to abort during provider initialization. + +Keep malloc perturbation enabled to retain detection of uninitialized and +use-after-free behavior without enabling the incompatible checked allocator. +--- + run.in | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/run.in b/run.in +index 4053fd2..be5cf48 100755 +--- a/run.in ++++ b/run.in +@@ -100,14 +100,12 @@ if [ -z "$VIRT_BUILDER_DIRS" ]; then + export VIRT_BUILDER_DIRS + fi + +-# This is a cheap way to find some use-after-free and uninitialized +-# read problems when using glibc. But if we are valgrinding then +-# don't use this because it can stop valgrind from working. ++# Perturb allocated and freed memory to find some use-after-free and ++# uninitialized read problems. Disable it when running under valgrind. + if [ -z "$VG" ]; then + random_val="$(@AWK@ 'BEGIN{srand(); print 1+int(255*rand())}' < /dev/null)" +- LD_PRELOAD="${LD_PRELOAD:+"$LD_PRELOAD:"}libc_malloc_debug.so.0" +- GLIBC_TUNABLES=glibc.malloc.check=1:glibc.malloc.perturb=$random_val +- export LD_PRELOAD GLIBC_TUNABLES ++ GLIBC_TUNABLES=glibc.malloc.perturb=$random_val ++ export GLIBC_TUNABLES + fi + + # Do we have libtool? If we have it then we can use it to make +-- +2.55.0 + diff --git a/base/comps/guestfs-tools/guestfs-tools.comp.toml b/base/comps/guestfs-tools/guestfs-tools.comp.toml index f5f859a3f46..9d868395313 100644 --- a/base/comps/guestfs-tools/guestfs-tools.comp.toml +++ b/base/comps/guestfs-tools/guestfs-tools.comp.toml @@ -15,6 +15,16 @@ description = "Drop the Windows phony-guest image (windows.img) from the test su type = "patch-add" source = "0001-tests-do-not-build-the-Windows-phony-guest-image.patch" +[[components.guestfs-tools.overlays]] +description = "Disable glibc's legacy checked allocator because it splits SymCrypt allocations between libc and malloc-debug; retain malloc perturbation and the full test suite. Tracks AB#23502." +type = "patch-add" +source = "0002-tests-disable-glibc-malloc-check.patch" + +[components.guestfs-tools.overlays.metadata] +category = "azl-temp-workaround" +upstream-status = "inapplicable" +bugs = [{ url = "https://dev.azure.com/mariner-org/mariner/_workitems/edit/23502" }] + # test-virt-diff.sh is a golden-output test that modifies the fedora phony guest # and expects virt-diff to report only those changes. In this build environment # virt-diff additionally reports the guest's separate ext2 /boot partition entries diff --git a/locks/guestfs-tools.lock b/locks/guestfs-tools.lock index c2fb58cba8e..ac7361ba8e8 100644 --- a/locks/guestfs-tools.lock +++ b/locks/guestfs-tools.lock @@ -3,5 +3,5 @@ version = 1 import-commit = 'a948c9aaa7a4fcdf132073c4a7781a5cfc413593' upstream-commit = 'a948c9aaa7a4fcdf132073c4a7781a5cfc413593' manual-bump = 2 -input-fingerprint = 'sha256:902ac834b52ce5ab7fe5d8ac9caa083e7e43ab2cf92eab29ba118a75d435b8ad' +input-fingerprint = 'sha256:1950dcfa6fb35f95edbe17eeb1a4cdf38553c002ea2092f684be0daea50a4c2e' resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e' diff --git a/specs/g/guestfs-tools/0002-tests-disable-glibc-malloc-check.patch b/specs/g/guestfs-tools/0002-tests-disable-glibc-malloc-check.patch new file mode 100644 index 00000000000..4625bf9f1b4 --- /dev/null +++ b/specs/g/guestfs-tools/0002-tests-disable-glibc-malloc-check.patch @@ -0,0 +1,42 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Tobias Brick +Date: Fri, 4 Sep 2026 15:36:00 +0000 +Subject: [PATCH] tests: disable glibc malloc check + +The legacy glibc malloc checker interposes allocation APIs through +libc_malloc_debug.so.0. SymCrypt has unversioned allocator references that +can bind aligned_alloc to libc while binding free to the debug allocator, +causing OpenSSL consumers to abort during provider initialization. + +Keep malloc perturbation enabled to retain detection of uninitialized and +use-after-free behavior without enabling the incompatible checked allocator. +--- + run.in | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/run.in b/run.in +index 4053fd2..be5cf48 100755 +--- a/run.in ++++ b/run.in +@@ -100,14 +100,12 @@ if [ -z "$VIRT_BUILDER_DIRS" ]; then + export VIRT_BUILDER_DIRS + fi + +-# This is a cheap way to find some use-after-free and uninitialized +-# read problems when using glibc. But if we are valgrinding then +-# don't use this because it can stop valgrind from working. ++# Perturb allocated and freed memory to find some use-after-free and ++# uninitialized read problems. Disable it when running under valgrind. + if [ -z "$VG" ]; then + random_val="$(@AWK@ 'BEGIN{srand(); print 1+int(255*rand())}' < /dev/null)" +- LD_PRELOAD="${LD_PRELOAD:+"$LD_PRELOAD:"}libc_malloc_debug.so.0" +- GLIBC_TUNABLES=glibc.malloc.check=1:glibc.malloc.perturb=$random_val +- export LD_PRELOAD GLIBC_TUNABLES ++ GLIBC_TUNABLES=glibc.malloc.perturb=$random_val ++ export GLIBC_TUNABLES + fi + + # Do we have libtool? If we have it then we can use it to make +-- +2.55.0 + diff --git a/specs/g/guestfs-tools/guestfs-tools.spec b/specs/g/guestfs-tools/guestfs-tools.spec index a24bdd69b2f..83c13ae8e67 100644 --- a/specs/g/guestfs-tools/guestfs-tools.spec +++ b/specs/g/guestfs-tools/guestfs-tools.spec @@ -19,7 +19,7 @@ Summary: Tools to access and modify virtual machine disk images Name: guestfs-tools Version: 1.55.5 -Release: 4%{?dist} +Release: 5%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later # Build only for architectures that have a kernel @@ -119,6 +119,7 @@ Obsoletes: libguestfs-tools-c <= 1:1.45.2-1 Patch0: 0001-tests-do-not-build-the-Windows-phony-guest-image.patch +Patch1: 0002-tests-disable-glibc-malloc-check.patch %description guestfs-tools is a set of tools that can be used to make batch configuration changes to guests, get disk used/free statistics