[SSSD] [PATCH] Guard against segfault in ping_check()

Stephen Gallagher sgallagh at redhat.com
Tue Dec 13 16:01:06 UTC 2011


On Tue, 2011-12-13 at 10:59 -0500, Simo Sorce wrote:
> On Tue, 2011-12-13 at 10:36 -0500, Stephen Gallagher wrote:
> > On Tue, 2011-12-13 at 10:32 -0500, Simo Sorce wrote:
> > > > Looking at this closely, I think what probably happened is that the
> > > > child died while waiting for the ping_check to time out, so that when it
> > > > finally returned, the memory for the mt_svc object had been freed.
> > > > Because we then use talloc_get_type() to retrieve that memory, it
> > > > detects that it's invalid and simply returns NULL (which we then
> > > > dereference and crash on).
> > > 
> > > maybe we should use talloc_get_type_abort() here ...
> > 
> > Nack. I really, really don't want it to be possible for the monitor to
> > crash.
> 
> In this case it makes no difference. If you reference freed memory or
> 'random' memory you will end up crashing as well.
> 
> The point is that we should never get to a point where talloc_get_type()
> fails and return NULL, unless it is legal to pass NULL in as input.
> 
> I am all for not having the monitor crash of course.
> 
> Simo.
> 

Well, in this particular case, our answer if it returns NULL will be to
just exit and do nothing, which will keep the monitor running.

But as I said in my earlier comments, I think I identified the reason
why it was coming up with NULL anyway.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111213/d27ad48c/attachment.sig>


More information about the sssd-devel mailing list