[SSSD] [PATCH] sss_autofs: Check return value of autofs make request

Lukas Slebodnik lslebodn at redhat.com
Tue May 27 13:52:23 UTC 2014


ehlo,

There were two different crashed in BZ1079237 [1]
The first one was in sssd_be (it was fixed commit e18d5c703c529f99bd375da887d9)
and the second one in sss autofs plugin. (client code)

Attached patches should fix the sond crash.

How to reproduce?
    a) -- revert commit e18d5c703c529f99bd375da887d9
       -- have more then one attribute "automountKey" in LDAP entry
       -- call automount -m
    b) #can be reproduced with current master
       -- use small value of option timeout in autofs section (can be default)
       -- attach gdb to the autof responder
       -- add breakpoint to the function b setautomntent_send and continue
       -- call automount -m
       -- gdb in autofs responder will interrupt execution (do nothing)
       -- automount will crash after few seconds (60-120)
LS

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1079237
-------------- next part --------------
>From 04d0be01e788805965f81594a5875aa4f01f117c Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Tue, 27 May 2014 13:55:26 +0200
Subject: [PATCH 1/2] sss_autofs: Check return value of autofs make request

The return value of function sss_autofs_make_request was not checked.
    (returned value was SSS_STATUS_UNAVAIL)
Unfotunatelly, errnop was zero; buffer "repbuf" was not initialised
and automount crashed in sss_autofs plugin.

Resolves:
https://fedorahosted.org/sssd/ticket/2288
---
 src/sss_client/autofs/sss_autofs.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/src/sss_client/autofs/sss_autofs.c b/src/sss_client/autofs/sss_autofs.c
index 49e130282e3e89b6a0f3b5683d78113d4fde8739..787b9f2b5161af85690e8c16e34cd42a527f39dd 100644
--- a/src/sss_client/autofs/sss_autofs.c
+++ b/src/sss_client/autofs/sss_autofs.c
@@ -89,9 +89,9 @@ _sss_setautomntent(const char *mapname, void **context)
     rd.data = name;
     rd.len = name_len + 1;
 
-    sss_autofs_make_request(SSS_AUTOFS_SETAUTOMNTENT, &rd,
-                            &repbuf, &replen, &errnop);
-    if (errnop != 0) {
+    ret = sss_autofs_make_request(SSS_AUTOFS_SETAUTOMNTENT, &rd,
+                                  &repbuf, &replen, &errnop);
+    if (ret != SSS_STATUS_SUCCESS) {
         free(name);
         ret = errnop;
         goto out;
@@ -306,10 +306,10 @@ _sss_getautomntent_r(char **key, char **value, void *context)
     rd.data = data;
     rd.len = data_len;
 
-    sss_autofs_make_request(SSS_AUTOFS_GETAUTOMNTENT, &rd,
-                            &repbuf, &replen, &errnop);
+    ret = sss_autofs_make_request(SSS_AUTOFS_GETAUTOMNTENT, &rd,
+                                  &repbuf, &replen, &errnop);
     free(data);
-    if (errnop != 0) {
+    if (ret != SSS_STATUS_SUCCESS) {
         ret = errnop;
         goto out;
     }
@@ -404,10 +404,10 @@ _sss_getautomntbyname_r(const char *key, char **value, void *context)
     rd.data = data;
     rd.len = data_len;
 
-    sss_autofs_make_request(SSS_AUTOFS_GETAUTOMNTBYNAME, &rd,
-                            &repbuf, &replen, &errnop);
+    ret = sss_autofs_make_request(SSS_AUTOFS_GETAUTOMNTBYNAME, &rd,
+                                  &repbuf, &replen, &errnop);
     free(data);
-    if (errnop != 0) {
+    if (ret != SSS_STATUS_SUCCESS) {
         ret = errnop;
         goto out;
     }
@@ -462,9 +462,9 @@ _sss_endautomntent(void **context)
     free(fctx->mapname);
     free(fctx);
 
-    sss_autofs_make_request(SSS_AUTOFS_ENDAUTOMNTENT,
-                            NULL, NULL, NULL, &errnop);
-    if (errnop != 0) {
+    ret = sss_autofs_make_request(SSS_AUTOFS_ENDAUTOMNTENT,
+                                  NULL, NULL, NULL, &errnop);
+    if (ret != SSS_STATUS_SUCCESS) {
         ret = errnop;
         goto out;
     }
-- 
1.9.3

-------------- next part --------------
>From a5911ab994c06978e0a0b78928553d7868afe604 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Tue, 27 May 2014 14:53:11 +0200
Subject: [PATCH 2/2] sss_autofs: Do not try to free empty autofs context

If initialisation fails in function _sss_setautomntent, context will not be
initialized and automount client will crash.
The function _sss_endautomntent should not try to dereference NULL pointer.

Resolves:
https://fedorahosted.org/sssd/ticket/2288
---
 src/sss_client/autofs/sss_autofs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/sss_client/autofs/sss_autofs.c b/src/sss_client/autofs/sss_autofs.c
index 787b9f2b5161af85690e8c16e34cd42a527f39dd..02f91ab2b3d29a189e949f6a8d645ea4ccd7f6e3 100644
--- a/src/sss_client/autofs/sss_autofs.c
+++ b/src/sss_client/autofs/sss_autofs.c
@@ -459,8 +459,10 @@ _sss_endautomntent(void **context)
 
     fctx = (struct automtent *) *context;
 
-    free(fctx->mapname);
-    free(fctx);
+    if (fctx != NULL) {
+        free(fctx->mapname);
+        free(fctx);
+    }
 
     ret = sss_autofs_make_request(SSS_AUTOFS_ENDAUTOMNTENT,
                                   NULL, NULL, NULL, &errnop);
-- 
1.9.3



More information about the sssd-devel mailing list