[SSSD] [PATCHES] Do not call sss_cmd_done in function check_cache
Lukas Slebodnik
lslebodn at redhat.com
Tue Jun 25 08:36:14 UTC 2013
ehlo,
Attached patches should fix https://fedorahosted.org/sssd/ticket/1980
The first patch adds check after sysdb_getnetgr. If sysdb_getnetgr returns more
result than 1, sssd will return error. sysdb_getpwnam has already had
this check.
The second patch removes function call sss_cmd_done inside of check_cache,
because function is sss_cmd_done is called in parent functions.
This was a reason of sssd crash.
How to reproduce this crash.
1.Add Netgroup to sysdb cache with base cn=Netgroups,cn=<domain>,cn=sysdb
This netgroup should have the same attribute (name or nameAlias or memberOf)
as another netgroup.
2. call sudo with user, which is member of ^^^ netgroup.
Those patches fix only sssd crash, but we should find out:
Why were those netgroups stored in sysdb.
LS
-------------- next part --------------
>From 5877db33fc0d52cf31f8b052a8a10ed16a307b0c Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Tue, 25 Jun 2013 09:01:45 +0200
Subject: [PATCH 1/2] Handle too many results from getnetgr.
---
src/responder/nss/nsssrv_netgroup.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/src/responder/nss/nsssrv_netgroup.c b/src/responder/nss/nsssrv_netgroup.c
index 4ec4161cf9c043792fffede1aa95acaf929a7071..12be52bf832cc5315f29b8faac22d4b6c44b3b22 100644
--- a/src/responder/nss/nsssrv_netgroup.c
+++ b/src/responder/nss/nsssrv_netgroup.c
@@ -363,7 +363,14 @@ static errno_t setnetgrent_retry(struct tevent_req *req)
}
ret = lookup_netgr_step(step_ctx);
- if (ret != EOK) {
+ switch (ret) {
+ case EOK:
+ break;
+ case EMSGSIZE:
+ state->netgr->ready = true;
+ ret = ENOENT;
+ /* FALLTHROUGH */
+ default:
goto done;
}
tevent_req_done(req);
@@ -459,6 +466,11 @@ static errno_t lookup_netgr_step(struct setent_step_ctx *step_ctx)
/* Look up the netgroup in the cache */
ret = sysdb_getnetgr(step_ctx->dctx, sysdb, dom, name,
&step_ctx->dctx->res);
+ if (step_ctx->dctx->res->count > 1) {
+ DEBUG(SSSDBG_FATAL_FAILURE,
+ ("getnetgr call returned more than one result !?!\n"));
+ return EMSGSIZE;
+ }
if (ret == ENOENT) {
/* This netgroup was not found in this domain */
if (!step_ctx->dctx->check_provider) {
--
1.8.1.4
-------------- next part --------------
>From 33cd2be90bc8d7e7b3dab9c8719732bce205a31f Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Tue, 25 Jun 2013 09:44:17 +0200
Subject: [PATCH 2/2] Do not call sss_cmd_done in function check_cache.
Function sysdb_getpwnam return more results than 1 and therefore sss_cmd_done
was called. Inside of function sss_cmd_done memory was freed,
but this freed memory was used in caller functions, therefore sssd crashed.
https://fedorahosted.org/sssd/ticket/1980
---
src/responder/nss/nsssrv_cmd.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index 3e5e8a78cf16550130be86114380df2c8a8d7a42..62a564a41c2a6173f13b13bb23f24fe8438ab8a6 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -494,7 +494,6 @@ static int nss_cmd_getpw_send_reply(struct nss_dom_ctx *dctx, bool filter)
static void nsssrv_dp_send_acct_req_done(struct tevent_req *req);
/* FIXME: do not check res->count, but get in a msgs and check in parent */
-/* FIXME: do not sss_cmd_done, but return error and let parent do it */
errno_t check_cache(struct nss_dom_ctx *dctx,
struct nss_ctx *nctx,
struct ldb_result *res,
@@ -518,11 +517,6 @@ errno_t check_cache(struct nss_dom_ctx *dctx,
(res->count > 1)) {
DEBUG(1, ("getpwXXX call returned more than one result!"
" DB Corrupted?\n"));
- ret = nss_cmd_send_error(cmdctx, ENOENT);
- if (ret != EOK) {
- NSS_CMD_FATAL_ERROR_CODE(cctx, ENOENT);
- }
- sss_cmd_done(cctx, cmdctx);
return ENOENT;
}
--
1.8.1.4
More information about the sssd-devel
mailing list