Bug#1098226: perl: thread creation while a directory handle is open does a fchdir, affecting other threads

From	Vincent Lefevre <vincent@vinc17.net>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#1098226: perl: thread creation while a directory handle is open does a fchdir, affecting other threads
Date	2025-02-18 17:10 +0100
Message-ID	<Khykx-aB2-1@gated-at.bofh.it> (permalink)
References	(1 earlier) <KhvmF-8v9-19@gated-at.bofh.it> <Khvwl-8On-1@gated-at.bofh.it> <KhvZn-8YF-1@gated-at.bofh.it> <KhiSu-hAta-1@gated-at.bofh.it> <KhvZn-8YF-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

Control: reassign -1 perl 5.40.1-2
Control: retitle -1 perl: thread creation while a directory handle is open does a fchdir, affecting other threads (race condition)
Control: tags -1 security upstream
Control: severity -1 grave
Control: forwarded -1 https://github.com/Perl/perl5/issues/23010

This is a bug visible in the perl code, so I've just reported the bug
upstream.

(Not sure about the severity, but this can yield incorrect file
operations in the involved directory, which may be very problematic
if this directory is untrusted.)

On 2025-02-18 14:26:54 +0100, Vincent Lefevre wrote:
> Hmm... There's a fchdir in the strace output. If the current directory
> is global to the process, this could be an issue. I now really suspect
> a bug in perl.

Yes, thread creation does a chdir when a directory handle is open.
As the current working directory is global to the process, this
can affect other threads, if they do file operations with relative
pathnames. Even though the current working directory is set back
to the old value, this is a race condition, which can affect real
scripts (this is how I identified this bug).

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)

Back to linux.debian.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#1098226: linux-image-6.12.13-amd64: newfstatat syscall ENOENT failure in multithreaded program Vincent Lefevre <vincent@vinc17.net> - 2025-02-18 14:00 +0100
  Bug#1098226: linux-image-6.12.13-amd64: newfstatat syscall ENOENT failure in multithreaded program Vincent Lefevre <vincent@vinc17.net> - 2025-02-18 14:10 +0100
    Bug#1098226: linux-image-6.12.13-amd64: newfstatat syscall ENOENT failure in multithreaded program Vincent Lefevre <vincent@vinc17.net> - 2025-02-18 14:40 +0100
      Bug#1098226: perl: thread creation while a directory handle is open does a fchdir, affecting other threads Vincent Lefevre <vincent@vinc17.net> - 2025-02-18 17:10 +0100

csiph-web