SSSD / sssd

#3724 Access after free during kcm shutdown with a non-empty queue
Closed: cloned-to-github by pbrezina. Opened by pbrezina.

Closed: cloned-to-github
Reopen Issue

Access after free during kcm shutdown with a non-empty queue. req is allocated on state at kcm_op_queue_send, then assigned to state->entry->req. If we free state, it first frees allocated req and then, state->entry which calls the destructor kcm_op_queue_entry_destructor which calls tevent_req_done(next_req->req) -> access after free.

Possible solution: make sure state->entry is freed first (add destructor to state)

Metadata Update from @pbrezina:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1572982

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 1.16.2

I tried the suggested solution, but it didn't work for me. Given that time is short before the next release, I'll move the ticket for the time being to 1.16.3

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 1.16.3 (was: SSSD 1.16.2)

Metadata Update from @fidencio:
- Issue assigned to fidencio

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 1.16.4 (was: SSSD 1.16.3)

Metadata Update from @fidencio:
- Assignee reset

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 2.2 (was: SSSD 1.16.4)
- Issue tagged with: KCM

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 2.3 (was: SSSD 2.2)

Metadata Update from @thalman:
- Issue tagged with: bugzilla

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4733

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata Update from @pbrezina:
- Issue close_status updated to: cloned-to-github
- Issue status updated to: Closed (was: Open)
Metadata
None

KCM bugzilla

None
None
High
https://bugzilla.redhat.com/show_bug.cgi?id=1572982
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.