[SSSD] [PATCH] Check slot validity before MC_SLOT_TO_PTR.
Michal Židek
mzidek at redhat.com
Mon Sep 16 16:16:15 UTC 2013
On 09/14/2013 12:35 AM, Lukas Slebodnik wrote:
> On (13/09/13 19:17), Michal Židek wrote:
>> On 09/13/2013 05:58 PM, Michal Židek wrote:
>>> Hello,
>>>
>>> This patch should add another line of defence against memory cache
>>> problems caused by accessing slot outside of bounds.
>>>
>>> Thanks
>>> Michal
>>>
>>
>> After discussion with Lukas I am attaching alternative version
>> without the call to save the corrupted cache.
>>
>> Thanks
>> Michal
>>
>
> I tested patch with latest sssd-1-9 on RHEL6.
>
> Message was written to the sssd_nss.log:
> (Sat Sep 14 00:19:24 2013) [sssd[nss]] [sss_mc_get_next_slot_with_hash]
> (0x0010): Corrupted fastcache. Slot number too big.
>
> But it seems that sssd_nss crashed.
>
> Program received signal SIGILL, Illegal instruction.
> 0x00007fa63f8b5b03 in mabort () from /lib64/libc.so.6
> #0 0x00007fa63f8b5b03 in mabort () from /lib64/libc.so.6
> No symbol table info available.
> #1 0x0000000000000008 in ?? ()
> No symbol table info available.
> #2 0x0000000001086cf0 in ?? ()
> No symbol table info available.
> #3 0x00000000010842a0 in ?? ()
> No symbol table info available.
> #4 0x00000000004288de in sss_mc_find_free_slots (_mcc=0x1086cf0, rec_len=252, key=<value optimized out>, _rec=0x7fff1b6bb008) at src/responder/nss/nsssrv_mmap_cache.c:495
> tot_slots = <value optimized out>
> i = <value optimized out>
> rec = <value optimized out>
> cur = 0
> t = <value optimized out>
> used = true
> #5 sss_mc_get_record (_mcc=0x1086cf0, rec_len=252, key=<value optimized out>, _rec=0x7fff1b6bb008) at src/responder/nss/nsssrv_mmap_cache.c:637
> mcc = 0x7fa632dfa038
> old_rec = <value optimized out>
> rec = <value optimized out>
> old_slots = <value optimized out>
> num_slots = 8
> base_slot = <value optimized out>
> ret = 853516376
> i = <value optimized out>
> __FUNCTION__ = "sss_mc_get_record"
> #6 0x0000000000428eee in sss_mmap_cache_pw_store (_mcc=0x10842a0, name=0x7fff1b6bb140, pw=0x7fff1b6bb150, uid=126516, gid=16000, gecos=0x7fff1b6bb180, homedir=0x7fff1b6bb170, shell=0x7fff1b6bb160) at src/responder/nss/nsssrv_mmap_cache.c:731
> mcc = 0x1086cf0
> rec = <value optimized out>
> data = <value optimized out>
> uidkey = {str = 0x7fff1b6bb010 "126516", len = 7}
> uidstr = "126516\000\000\021)\213"
> data_len = 204
> rec_len = 252
> pos = <value optimized out>
> ret = <value optimized out>
>
> LS
>
Good catch.
In function sss_mc_get_next_slot_with_hash I returned MC_INVALID_VAL in
case of failure. This function is called in function
sss_mc_rm_rec_from_chain, which returns no error code. So the upper
layers worked with the wrong MC_INVALID_VAL, as if it was valid value
and the MC_PTR_TO_SLOT resulted in some big slot number (which probably
caused the crash). In this patch I populate the information about
failure to to sss_mc_invalidate_rec and terminate it if necessary.
New patch is attached. Please run the testing script with your
configuration that failed to see if it is fixed.
Thanks
Michal
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Check-slot-validity-before-MC_SLOT_TO_PTR.patch
Type: text/x-patch
Size: 7437 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130916/be8ce6b2/attachment.bin>
More information about the sssd-devel
mailing list