[SSSD] Patch to fix LDAP ID backend GSSAPI credential expired messages

Stephen Gallagher sgallagh at redhat.com
Mon Apr 12 20:23:26 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/07/2010 10:10 AM, Eugene Indenbom wrote:
> --- 0003-Fixed-recursive-sdap_handle-disconnect-sequence-from.patch
> 
> This patch fixes a critical bug of accessing freed memory in
> sdap_handle_release. The problem can be reproduced as follows:
> 1. Break LDAP connection when LDAP query is in progress (e.g. by
> restarting directory server)
> 2. sdap_process_result detects communication error and calls
> sdap_handle_release
> 3. sdap_handle_release calls active sdap_op callback
> 4. callback deletes sdap_handle
> 5. sdap_release_handle segfaults or asserts on access to deallocated memory
> 

I am unable to find any code path such that step 4 (callback deletes
sdap_handle) is possible. Every callback that we ever add with
sdap_op_add() behaves the same way when called from sdap_handle_release().

Since sdap_handle_release() invokes the callbacks with the error code of
EIO, they all immediately set tevent_req_error() and return. There is no
path in which they delete any memory.

Furthermore, all sdap_op_add() calls use a memory heirarchy that is
either below or completely unrelated to the sdap_handle hierarchy. So
calling talloc_free() on the sdap_op object cannot free the sdap_handle.

Eugene, if you are sure that this exists in the current master, can you
point out the relevant problem area?

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkvDgT4ACgkQeiVVYja6o6N14wCfQmIuQ6R+ZYVkO7SRe/IYfIZm
PjEAn0w41Yc8jhHuKJyeoaHTCHFCgS0/
=iQRe
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list