[SSSD] [PATCHES] Do not call sss_cmd_done in function check_cache

Lukas Slebodnik lslebodn at redhat.com
Tue Jun 25 08:36:14 UTC 2013


ehlo,

Attached patches should fix https://fedorahosted.org/sssd/ticket/1980

The first patch adds check after sysdb_getnetgr. If sysdb_getnetgr returns more
result than 1, sssd will return error. sysdb_getpwnam has already had
this check.

The second patch removes function call sss_cmd_done inside of check_cache,
because function is sss_cmd_done is called in parent functions.
This was a reason of sssd crash.

How to reproduce this crash.
1.Add Netgroup to sysdb cache with base cn=Netgroups,cn=<domain>,cn=sysdb
  This netgroup should have the same attribute (name or nameAlias or memberOf)
  as another netgroup.
2. call sudo with user, which is member of ^^^ netgroup.

Those patches fix only sssd crash, but we should find out:
  Why were those netgroups stored in sysdb.

LS
-------------- next part --------------
>From 5877db33fc0d52cf31f8b052a8a10ed16a307b0c Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Tue, 25 Jun 2013 09:01:45 +0200
Subject: [PATCH 1/2] Handle too many results from getnetgr.

---
 src/responder/nss/nsssrv_netgroup.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/responder/nss/nsssrv_netgroup.c b/src/responder/nss/nsssrv_netgroup.c
index 4ec4161cf9c043792fffede1aa95acaf929a7071..12be52bf832cc5315f29b8faac22d4b6c44b3b22 100644
--- a/src/responder/nss/nsssrv_netgroup.c
+++ b/src/responder/nss/nsssrv_netgroup.c
@@ -363,7 +363,14 @@ static errno_t setnetgrent_retry(struct tevent_req *req)
         }
 
         ret = lookup_netgr_step(step_ctx);
-        if (ret != EOK) {
+        switch (ret) {
+        case EOK:
+            break;
+        case EMSGSIZE:
+            state->netgr->ready = true;
+            ret = ENOENT;
+            /* FALLTHROUGH */
+        default:
             goto done;
         }
         tevent_req_done(req);
@@ -459,6 +466,11 @@ static errno_t lookup_netgr_step(struct setent_step_ctx *step_ctx)
         /* Look up the netgroup in the cache */
         ret = sysdb_getnetgr(step_ctx->dctx, sysdb, dom, name,
                              &step_ctx->dctx->res);
+        if (step_ctx->dctx->res->count > 1) {
+            DEBUG(SSSDBG_FATAL_FAILURE,
+                  ("getnetgr call returned more than one result !?!\n"));
+            return EMSGSIZE;
+        }
         if (ret == ENOENT) {
             /* This netgroup was not found in this domain */
             if (!step_ctx->dctx->check_provider) {
-- 
1.8.1.4

-------------- next part --------------
>From 33cd2be90bc8d7e7b3dab9c8719732bce205a31f Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Tue, 25 Jun 2013 09:44:17 +0200
Subject: [PATCH 2/2] Do not call sss_cmd_done in function check_cache.

Function sysdb_getpwnam return more results than 1 and therefore sss_cmd_done
was called. Inside of function sss_cmd_done memory was freed,
but this freed memory was used in caller functions, therefore sssd crashed.

https://fedorahosted.org/sssd/ticket/1980
---
 src/responder/nss/nsssrv_cmd.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index 3e5e8a78cf16550130be86114380df2c8a8d7a42..62a564a41c2a6173f13b13bb23f24fe8438ab8a6 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -494,7 +494,6 @@ static int nss_cmd_getpw_send_reply(struct nss_dom_ctx *dctx, bool filter)
 static void nsssrv_dp_send_acct_req_done(struct tevent_req *req);
 
 /* FIXME: do not check res->count, but get in a msgs and check in parent */
-/* FIXME: do not sss_cmd_done, but return error and let parent do it */
 errno_t check_cache(struct nss_dom_ctx *dctx,
                     struct nss_ctx *nctx,
                     struct ldb_result *res,
@@ -518,11 +517,6 @@ errno_t check_cache(struct nss_dom_ctx *dctx,
             (res->count > 1)) {
         DEBUG(1, ("getpwXXX call returned more than one result!"
                   " DB Corrupted?\n"));
-        ret = nss_cmd_send_error(cmdctx, ENOENT);
-        if (ret != EOK) {
-            NSS_CMD_FATAL_ERROR_CODE(cctx, ENOENT);
-        }
-        sss_cmd_done(cctx, cmdctx);
         return ENOENT;
     }
 
-- 
1.8.1.4



More information about the sssd-devel mailing list