systemd-udevd crashed with SIGSEGV with rules file appending large number of tags

StacktraceTop:
 device_read_db_aux ()
 sd_device_get_tag_next ()
 device_properties_prepare ()
 sd_device_get_property_value ()
 udev_device_get_action ()

This crashes in src/libsystemd/sd-device/sd-device.c, device_properties_prepare():

                char *tags = NULL;
                while ((tag = sd_device_get_tag_next(device)))
                        tags = strjoina(tags, ":", tag);

strjoina() (which essentially is alloca() with some automatic size determination) is very efficient with a few tags, but it has an undefined upper bound and undefined behaviour on stack overflow, i. e. there is no way to find out when it failed.

Upstream report: https://github.com/systemd/systemd/issues/2954

@Jamie: If you want to test packages with the fix, they are in https://launchpad.net/~pitti/+archive/ubuntu/systemd .

The final fix now landed in upstream master, and I cherry-picked it into our packaging git.

This bug was fixed in the package systemd - 229-4ubuntu1

---------------
systemd (229-4ubuntu1) xenial; urgency=medium

  * Merge with Debian unstable. Remaining Ubuntu changes:
    - Hack to support system-image read-only /etc, and modify files in
      /etc/writable/ instead.

    Upgrade fixes, keep until 16.04 LTS release:
    - systemd Conflicts/Replaces/Provides systemd-services.
    - Remove obsolete systemd-logind upstart job.
    - Clean up obsolete /etc/udev/rules.d/README.
    - systemd.postinst: Migrate mountall specific fstab options to standard
      util-linux "nofail" option.
    - systemctl: Don't forward telinit u to upstart. This works around
      upstart's Restart() always reexec'ing /sbin/init on Restart(), even if
      that changes to point to systemd during the upgrade. This avoids running
      systemd during a dist-upgrade. (LP: #1430479)
    - Provide shutdown fallback for upstart. (LP: #1370329)
    - Break lvm (<< 2.02.133-1ubuntu1) and remove our dummy /etc/init.d/lvm2
      on upgrades, as it's shipped by lvm2 now.
    - Make udev break on mdadm << 3.3-2ubuntu3, as udev's init script dropped
      the "Provides: raid-mdadm".
    - Clean up /var/log/udev on upgrade (which is written under upstart, but
      not under systemd). (LP: #1537211)
    - Migrate existing s390x network configuration to new names. (LP: #1526808)
    - systemd.postinst: Bump Version comparison for migrating the UTC setting
      from /etc/default/rcS to /etc/adjtime, to run it for upgrades to 16.04.
    - VMWare BIOS reports implausibly high onboard numbers. This got fixed in
      upstream commit 6c1e69f9. Migrate names in ifupdown accordingly.
      (LP: #1550539)
    - udev: Don't kill peer processes if we don't run in a cgroup. This happens
      when running under/upgrading from upstart. udevd and everything else run
      in the root hierarchy on all controllers then, and the alleged cleanup of
      "our" cgroup becomes a system-wide killing spree. (LP: #1555237)

systemd (229-4) unstable; urgency=medium

  * Fix assertion crash when processing a (broken) device without a sysfs
    path. (Closes: #819290, LP: #1560695)
  * Fix crash when shutdown is issued from a non-tty. (LP: #1553040)
  * networkd: Stay running while any non-loopback interface is up.
    (Closes: #819414)
  * Fix reading uint32 D-Bus properties on big-endian.
  * Fix crash if an udev device has many tags or devlinks. (LP: #1564976)
  * systemctl, loginctl, etc.: Don't start polkit agent when running as root.
    (LP: #1565617)
  * keymap: Add Add HP ZBook (LP: #1535219) and HP ProBook 440 G3.
  * systemd.resource-control.5: Fix links to cgroup documentation on
    kernel.org. (Closes: #819970)
  * Install test-udev into libudev-dev, so that we have it available for
    autopkgtests.
  * Add "udev" autopkgtest for running the upstream test/udev-test.pl.

 -- Martin Pitt <email address hidden> Thu, 07 Apr 2016 09:53:25 +0200