[SSSD] [PATCH] Check slot validity before MC_SLOT_TO_PTR.

Michal Židek mzidek at redhat.com
Mon Sep 16 16:16:15 UTC 2013


On 09/14/2013 12:35 AM, Lukas Slebodnik wrote:
> On (13/09/13 19:17), Michal Židek wrote:
>> On 09/13/2013 05:58 PM, Michal Židek wrote:
>>> Hello,
>>>
>>> This patch should add another line of defence against memory cache
>>> problems caused by accessing slot outside of bounds.
>>>
>>> Thanks
>>> Michal
>>>
>>
>> After discussion with Lukas I am attaching alternative version
>> without the call to save the corrupted cache.
>>
>> Thanks
>> Michal
>>
>
> I tested patch with latest sssd-1-9 on RHEL6.
>
> Message was written to the sssd_nss.log:
> (Sat Sep 14 00:19:24 2013) [sssd[nss]] [sss_mc_get_next_slot_with_hash]
> (0x0010): Corrupted fastcache. Slot number too big.
>
> But it seems that sssd_nss crashed.
>
> Program received signal SIGILL, Illegal instruction.
> 0x00007fa63f8b5b03 in mabort () from /lib64/libc.so.6
> #0  0x00007fa63f8b5b03 in mabort () from /lib64/libc.so.6
> No symbol table info available.
> #1  0x0000000000000008 in ?? ()
> No symbol table info available.
> #2  0x0000000001086cf0 in ?? ()
> No symbol table info available.
> #3  0x00000000010842a0 in ?? ()
> No symbol table info available.
> #4  0x00000000004288de in sss_mc_find_free_slots (_mcc=0x1086cf0, rec_len=252, key=<value optimized out>, _rec=0x7fff1b6bb008) at src/responder/nss/nsssrv_mmap_cache.c:495
>          tot_slots = <value optimized out>
>          i = <value optimized out>
>          rec = <value optimized out>
>          cur = 0
>          t = <value optimized out>
>          used = true
> #5  sss_mc_get_record (_mcc=0x1086cf0, rec_len=252, key=<value optimized out>, _rec=0x7fff1b6bb008) at src/responder/nss/nsssrv_mmap_cache.c:637
>          mcc = 0x7fa632dfa038
>          old_rec = <value optimized out>
>          rec = <value optimized out>
>          old_slots = <value optimized out>
>          num_slots = 8
>          base_slot = <value optimized out>
>          ret = 853516376
>          i = <value optimized out>
>          __FUNCTION__ = "sss_mc_get_record"
> #6  0x0000000000428eee in sss_mmap_cache_pw_store (_mcc=0x10842a0, name=0x7fff1b6bb140, pw=0x7fff1b6bb150, uid=126516, gid=16000, gecos=0x7fff1b6bb180, homedir=0x7fff1b6bb170, shell=0x7fff1b6bb160) at src/responder/nss/nsssrv_mmap_cache.c:731
>          mcc = 0x1086cf0
>          rec = <value optimized out>
>          data = <value optimized out>
>          uidkey = {str = 0x7fff1b6bb010 "126516", len = 7}
>          uidstr = "126516\000\000\021)\213"
>          data_len = 204
>          rec_len = 252
>          pos = <value optimized out>
>          ret = <value optimized out>
>
> LS
>

Good catch.

In function sss_mc_get_next_slot_with_hash I returned MC_INVALID_VAL in 
case of failure. This function is called in function 
sss_mc_rm_rec_from_chain, which returns no error code. So the upper 
layers worked with the wrong MC_INVALID_VAL, as if it was valid value 
and the MC_PTR_TO_SLOT resulted in some big slot number (which probably 
caused the crash). In this patch I populate the information about 
failure to to sss_mc_invalidate_rec and terminate it if necessary.

New patch is attached. Please run the testing script with your 
configuration that failed to see if it is fixed.

Thanks
Michal

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Check-slot-validity-before-MC_SLOT_TO_PTR.patch
Type: text/x-patch
Size: 7437 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130916/be8ce6b2/attachment.bin>


More information about the sssd-devel mailing list