[SSSD] [PATCH] Guard against segfault in ping_check()

Stephen Gallagher sgallagh at redhat.com
Tue Dec 13 21:06:57 UTC 2011


On Tue, 2011-12-13 at 19:46 +0100, Jakub Hrozek wrote:
> On Tue, Dec 13, 2011 at 10:18:10AM -0500, Stephen Gallagher wrote:
> > On Tue, 2011-12-13 at 16:01 +0100, Jakub Hrozek wrote:
> > > https://fedorahosted.org/sssd/ticket/1090
> > > 
> > > Unfortunately there is not enough info in rhbz #754114 where the bug
> > > originated, so just band-aid the crash for now.
> > 
> > 
> > Nack.
> > 
> > Looking at this closely, I think what probably happened is that the
> > child died while waiting for the ping_check to time out, so that when it
> > finally returned, the memory for the mt_svc object had been freed.
> > Because we then use talloc_get_type() to retrieve that memory, it
> > detects that it's invalid and simply returns NULL (which we then
> > dereference and crash on).
> > 
> > The real solution here would be to ensure that we cancel the
> > DBusPendingCall with dbus_pending_call_cancel() if the mt_svc is freed.
> > 
> > So we need to modify the mt_svc structure to contain a DBusPendingCall *
> > attribute that we assign to it when service_send_ping() calls
> > sbus_conn_send() (currently, we just pass NULL for the 'pending' return
> > to ignore it).
> > 
> > Then, we need to make sure that the mt_svc destructor will call
> > dbus_pending_call_cancel() on mt_svc->pending, which will prevent us
> > from reaching the ping_check() function.
> > 
> > (Obviously, we need to NULLify the mt_svc->pending attribute once we
> > reach the ping_check() function correctly).
> > 
> > There's certainly no reason we can't ALSO include the band-aid of this
> > patch, but I'd rather fix the underlying problem.
> 
> Thank you for the detailed explanation. A new patch is attached.


Ack and pushed to master.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111213/90142261/attachment.sig>


More information about the sssd-devel mailing list