From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Sun, 13 Jul 2025 08:19:46 +0000 (+0900)
Subject: journald: do not read configs by journald fuzzers
X-Git-Tag: v258-rc1~34^2~14
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=32bd43d768a4bdd54481c5e37ce9ea3d1009a824;p=thirdparty%2Fsystemd.git

journald: do not read configs by journald fuzzers
---

diff --git a/src/journal/fuzz-journald-audit.c b/src/journal/fuzz-journald-audit.c
index 7558900ff51..07470ecd2f0 100644
--- a/src/journal/fuzz-journald-audit.c
+++ b/src/journal/fuzz-journald-audit.c
@@ -9,8 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 
         fuzz_setup_logging();
 
-        assert_se(manager_new(&m, /* namespace= */ NULL) >= 0);
-        dummy_manager_init(m, data, size);
+        dummy_manager_new(&m, data, size);
         process_audit_string(m, 0, m->buffer, size);
 
         return 0;
diff --git a/src/journal/fuzz-journald-kmsg.c b/src/journal/fuzz-journald-kmsg.c
index 2ef36172887..041662686e2 100644
--- a/src/journal/fuzz-journald-kmsg.c
+++ b/src/journal/fuzz-journald-kmsg.c
@@ -12,8 +12,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 
         fuzz_setup_logging();
 
-        assert_se(manager_new(&m, /* namespace= */ NULL) >= 0);
-        dummy_manager_init(m, data, size);
+        dummy_manager_new(&m, data, size);
         dev_kmsg_record(m, m->buffer, size);
 
         return 0;
diff --git a/src/journal/fuzz-journald-native-fd.c b/src/journal/fuzz-journald-native-fd.c
index 356e59046fb..a6ff87556d8 100644
--- a/src/journal/fuzz-journald-native-fd.c
+++ b/src/journal/fuzz-journald-native-fd.c
@@ -21,8 +21,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 
         fuzz_setup_logging();
 
-        assert_se(manager_new(&m, /* namespace= */ NULL) >= 0);
-        dummy_manager_init(m, NULL, 0);
+        dummy_manager_new(&m, NULL, 0);
 
         sealed_fd = memfd_new_and_seal(NULL, data, size);
         assert_se(sealed_fd >= 0);
diff --git a/src/journal/fuzz-journald-stream.c b/src/journal/fuzz-journald-stream.c
index 602bd59c45f..1ee49461d39 100644
--- a/src/journal/fuzz-journald-stream.c
+++ b/src/journal/fuzz-journald-stream.c
@@ -23,8 +23,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         fuzz_setup_logging();
 
         assert_se(socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0, stream_fds) >= 0);
-        assert_se(manager_new(&m, /* namespace= */ NULL) >= 0);
-        dummy_manager_init(m, NULL, 0);
+        dummy_manager_new(&m, NULL, 0);
 
         assert_se(stdout_stream_install(m, stream_fds[0], &stream) >= 0);
         fd0 = TAKE_FD(stream_fds[0]); /* avoid double close */
diff --git a/src/journal/fuzz-journald.c b/src/journal/fuzz-journald.c
index 0bb4d5d5650..b94a249c986 100644
--- a/src/journal/fuzz-journald.c
+++ b/src/journal/fuzz-journald.c
@@ -5,35 +5,33 @@
 #include "alloc-util.h"
 #include "fuzz-journald.h"
 #include "journald-manager.h"
+#include "tests.h"
 
-void dummy_manager_init(Manager *m, const uint8_t *buffer, size_t size) {
-        assert(m);
+void dummy_manager_new(Manager **ret, const uint8_t *buffer, size_t size) {
+        _cleanup_(manager_freep) Manager *m = NULL;
+
+        assert(ret);
 
+        ASSERT_OK(manager_new(&m));
+        manager_merge_configs(m);
         m->config.storage = STORAGE_NONE;
-        assert_se(sd_event_default(&m->event) >= 0);
+        ASSERT_OK(sd_event_default(&m->event));
+
+        if (buffer)
+                ASSERT_NOT_NULL(m->buffer = memdup_suffix0(buffer, size));
 
-        if (buffer) {
-                m->buffer = memdup_suffix0(buffer, size);
-                assert_se(m->buffer);
-        }
+        *ret = TAKE_PTR(m);
 }
 
 void fuzz_journald_processing_function(
                 const uint8_t *data,
                 size_t size,
-                void (*f)(Manager *m, const char *buf, size_t raw_len, const struct ucred *ucred, const struct timeval *tv, const char *label, size_t label_len)
-        ) {
-
-        _cleanup_(manager_freep) Manager *m = NULL;
-        char *label = NULL;
-        size_t label_len = 0;
-        struct ucred *ucred = NULL;
-        struct timeval *tv = NULL;
+                journal_process_t f) {
 
         if (size == 0)
                 return;
 
-        assert_se(manager_new(&m, /* namespace= */ NULL) >= 0);
-        dummy_manager_init(m, data, size);
-        (*f)(m, m->buffer, size, ucred, tv, label, label_len);
+        _cleanup_(manager_freep) Manager *m = NULL;
+        dummy_manager_new(&m, data, size);
+        f(m, m->buffer, size, /* ucred = */ NULL, /* tv = */ NULL, /* label = */ NULL, /* label_len = */ 0);
 }
diff --git a/src/journal/fuzz-journald.h b/src/journal/fuzz-journald.h
index 0d1ebce50a7..7eb491f36ad 100644
--- a/src/journal/fuzz-journald.h
+++ b/src/journal/fuzz-journald.h
@@ -3,10 +3,18 @@
 
 #include "journald-manager.h"
 
-void dummy_manager_init(Manager *m, const uint8_t *buffer, size_t size);
+typedef void (*journal_process_t)(
+                Manager *m,
+                const char *buf,
+                size_t raw_len,
+                const struct ucred *ucred,
+                const struct timeval *tv,
+                const char *label,
+                size_t label_len);
+
+void dummy_manager_new(Manager **ret, const uint8_t *buffer, size_t size);
 
 void fuzz_journald_processing_function(
                 const uint8_t *data,
                 size_t size,
-                void (*f)(Manager *m, const char *buf, size_t raw_len, const struct ucred *ucred, const struct timeval *tv, const char *label, size_t label_len)
-);
+                journal_process_t f);
diff --git a/src/journal/journald-config.c b/src/journal/journald-config.c
index cece07411f4..42245bf8d0d 100644
--- a/src/journal/journald-config.c
+++ b/src/journal/journald-config.c
@@ -32,7 +32,7 @@ void journal_config_done(JournalConfig *c) {
         free(c->tty_path);
 }
 
-static void journal_config_set_defaults(JournalConfig *c) {
+void journal_config_set_defaults(JournalConfig *c) {
         assert(c);
 
         journal_config_done(c);
@@ -105,7 +105,7 @@ static void manager_merge_forward_to_socket(Manager *m) {
                 m->config_by_cred.name ?:                               \
                 default_value
 
-static void manager_merge_configs(Manager *m) {
+void manager_merge_configs(Manager *m) {
         assert(m);
 
         /* From highest to lowest priority: cmdline, conf, cred */
@@ -330,10 +330,6 @@ void manager_load_config(Manager *m) {
 
         assert(m);
 
-        journal_config_set_defaults(&m->config_by_conf);
-        journal_config_set_defaults(&m->config_by_cred);
-        journal_config_set_defaults(&m->config_by_cmdline);
-
         manager_load_credentials(&m->config_by_cred);
         manager_parse_config_file(m);
 
diff --git a/src/journal/journald-config.h b/src/journal/journald-config.h
index 31077acba2d..c396c3a5603 100644
--- a/src/journal/journald-config.h
+++ b/src/journal/journald-config.h
@@ -83,6 +83,8 @@ typedef struct JournalConfig {
 } JournalConfig;
 
 void journal_config_done(JournalConfig *c);
+void journal_config_set_defaults(JournalConfig *c);
+void manager_merge_configs(Manager *m);
 void manager_load_config(Manager *m);
 int manager_dispatch_reload_signal(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata);
 
diff --git a/src/journal/journald-manager.c b/src/journal/journald-manager.c
index 727425225ff..b74dcfa7889 100644
--- a/src/journal/journald-manager.c
+++ b/src/journal/journald-manager.c
@@ -2193,7 +2193,7 @@ static int manager_refresh_idle_timer(Manager *m) {
         return 1;
 }
 
-static int manager_set_namespace(Manager *m, const char *namespace) {
+int manager_set_namespace(Manager *m, const char *namespace) {
         assert(m);
 
         if (!namespace)
@@ -2288,9 +2288,8 @@ int manager_reload_journals(Manager *m) {
         return 0;
 }
 
-int manager_new(Manager **ret, const char *namespace) {
+int manager_new(Manager **ret) {
         _cleanup_(manager_freep) Manager *m = NULL;
-        int r;
 
         assert(ret);
 
@@ -2324,11 +2323,9 @@ int manager_new(Manager **ret, const char *namespace) {
                 .sigrtmin18_info.memory_pressure_userdata = m,
         };
 
-        r = manager_set_namespace(m, namespace);
-        if (r < 0)
-                return r;
-
-        manager_load_config(m);
+        journal_config_set_defaults(&m->config_by_conf);
+        journal_config_set_defaults(&m->config_by_cred);
+        journal_config_set_defaults(&m->config_by_cmdline);
 
         *ret = TAKE_PTR(m);
         return 0;
diff --git a/src/journal/journald-manager.h b/src/journal/journald-manager.h
index 05a84bf8f18..a9ef3f394f8 100644
--- a/src/journal/journald-manager.h
+++ b/src/journal/journald-manager.h
@@ -172,7 +172,8 @@ void manager_dispatch_message(Manager *m, struct iovec *iovec, size_t n, size_t
 void manager_driver_message_internal(Manager *m, pid_t object_pid, const char *format, ...) _sentinel_;
 #define manager_driver_message(...) manager_driver_message_internal(__VA_ARGS__, NULL)
 
-int manager_new(Manager **ret, const char *namespace);
+int manager_new(Manager **ret);
+int manager_set_namespace(Manager *m, const char *namespace);
 int manager_init(Manager *m);
 Manager* manager_free(Manager *m);
 DEFINE_TRIVIAL_CLEANUP_FUNC(Manager*, manager_free);
diff --git a/src/journal/journald.c b/src/journal/journald.c
index 393e90e1b52..e7ed6a556c9 100644
--- a/src/journal/journald.c
+++ b/src/journal/journald.c
@@ -52,10 +52,16 @@ static int run(int argc, char *argv[]) {
 
         sigbus_install();
 
-        r = manager_new(&m, namespace);
+        r = manager_new(&m);
         if (r < 0)
                 return log_oom();
 
+        r = manager_set_namespace(m, namespace);
+        if (r < 0)
+                return r;
+
+        manager_load_config(m);
+
         r = manager_init(m);
         if (r < 0)
                 return r;