#63 Segmentation fault on repeated config file updates
Closed: Fixed Opened by sgallagh.

SSSD segfaults after the second or third time updating live when the config file changes. Looks like memory corruption in the domain list.

Program terminated with signal 11, Segmentation fault.
#0  0x0000003dcda823a4 in strcasecmp () from /lib64/libc.so.6
(gdb) bt
#0  0x0000003dcda823a4 in strcasecmp () from /lib64/libc.so.6
#1  0x0000000000406db1 in update_monitor_config (ctx=0x1ae7070)
    at ../../server/monitor/monitor.c:975
#2  0x0000000000405988 in monitor_signal_reconf (file_ctx=0x1ae8f10)
    at ../../server/monitor/monitor.c:523
#3  0x0000000000407524 in poll_config_file (ev=0x1ae6ba0, te=0x1b063a0, t=
      {tv_sec = 1245417365, tv_usec = 1117}, ptr=0x1ae8f10)
    at ../../server/monitor/monitor.c:1267
#4  0x0000003dcf202f35 in tevent_common_loop_timer_delay ()
   from /usr/lib64/libtevent.so.0
#5  0x0000003dcf2041ed in ?? () from /usr/lib64/libtevent.so.0
#6  0x0000003dcf204773 in ?? () from /usr/lib64/libtevent.so.0
#7  0x0000003dcf204846 in ?? () from /usr/lib64/libtevent.so.0
#8  0x00000000004185df in server_loop (main_ctx=0x1ae6cc0)
    at ../../server/util/server.c:350
#9  0x000000000040922b in main (argc=2, argv=0x7fff46a5c188)
    at ../../server/monitor/monitor.c:2113
(gdb) up
#1  0x0000000000406db1 in update_monitor_config (ctx=0x1ae7070)
    at ../../server/monitor/monitor.c:975
975             if (strcasecmp(dom->name, new_dom->name) == 0) break;
(gdb) print *dom
$1 = {name = 0x6f72502061746144 <Address 0x6f72502061746144 out of bounds>, 
  provider = 0x6f43207265646976 <Address 0x6f43207265646976 out of bounds>, 
  timeout = 1734960750, enumerate = 1952543349, fqnames = 105, legacy = 111, 
  mpg = 110, id_min = 0, id_max = 0, cache_credentials = false, 
  legacy_passwords = false, next = 0x21}

Fields changed

description: SSSD segfaults after the second or third time updating live when the config file changes. Looks like memory corruption in the domain list.

Program terminated with signal 11, Segmentation fault.

0 0x0000003dcda823a4 in strcasecmp () from /lib64/libc.so.6

(gdb) bt

0 0x0000003dcda823a4 in strcasecmp () from /lib64/libc.so.6

1 0x0000000000406db1 in update_monitor_config (ctx=0x1ae7070)

at ../../server/monitor/monitor.c:975

2 0x0000000000405988 in monitor_signal_reconf (file_ctx=0x1ae8f10)

at ../../server/monitor/monitor.c:523

3 0x0000000000407524 in poll_config_file (ev=0x1ae6ba0, te=0x1b063a0, t=

  {tv_sec = 1245417365, tv_usec = 1117}, ptr=0x1ae8f10)
at ../../server/monitor/monitor.c:1267

4 0x0000003dcf202f35 in tevent_common_loop_timer_delay ()

from /usr/lib64/libtevent.so.0

5 0x0000003dcf2041ed in ?? () from /usr/lib64/libtevent.so.0

6 0x0000003dcf204773 in ?? () from /usr/lib64/libtevent.so.0

7 0x0000003dcf204846 in ?? () from /usr/lib64/libtevent.so.0

8 0x00000000004185df in server_loop (main_ctx=0x1ae6cc0)

at ../../server/util/server.c:350

9 0x000000000040922b in main (argc=2, argv=0x7fff46a5c188)

at ../../server/monitor/monitor.c:2113

(gdb) up

1 0x0000000000406db1 in update_monitor_config (ctx=0x1ae7070)

at ../../server/monitor/monitor.c:975

975 if (strcasecmp(dom->name, new_dom->name) == 0) break;
(gdb) print *dom
$1 = {name = 0x6f72502061746144

,
provider = 0x6f43207265646976
,
timeout = 1734960750, enumerate = 1952543349, fqnames = 105, legacy = 111,
mpg = 110, id_min = 0, id_max = 0, cache_credentials = false,
legacy_passwords = false, next = 0x21}
=> SSSD segfaults after the second or third time updating live when the config file changes. Looks like memory corruption in the domain list.
{{{
Program terminated with signal 11, Segmentation fault.

0 0x0000003dcda823a4 in strcasecmp () from /lib64/libc.so.6

(gdb) bt

0 0x0000003dcda823a4 in strcasecmp () from /lib64/libc.so.6

1 0x0000000000406db1 in update_monitor_config (ctx=0x1ae7070)

at ../../server/monitor/monitor.c:975

2 0x0000000000405988 in monitor_signal_reconf (file_ctx=0x1ae8f10)

at ../../server/monitor/monitor.c:523

3 0x0000000000407524 in poll_config_file (ev=0x1ae6ba0, te=0x1b063a0, t=

  {tv_sec = 1245417365, tv_usec = 1117}, ptr=0x1ae8f10)
at ../../server/monitor/monitor.c:1267

4 0x0000003dcf202f35 in tevent_common_loop_timer_delay ()

from /usr/lib64/libtevent.so.0

5 0x0000003dcf2041ed in ?? () from /usr/lib64/libtevent.so.0

6 0x0000003dcf204773 in ?? () from /usr/lib64/libtevent.so.0

7 0x0000003dcf204846 in ?? () from /usr/lib64/libtevent.so.0

8 0x00000000004185df in server_loop (main_ctx=0x1ae6cc0)

at ../../server/util/server.c:350

9 0x000000000040922b in main (argc=2, argv=0x7fff46a5c188)

at ../../server/monitor/monitor.c:2113

(gdb) up

1 0x0000000000406db1 in update_monitor_config (ctx=0x1ae7070)

at ../../server/monitor/monitor.c:975

975 if (strcasecmp(dom->name, new_dom->name) == 0) break;
(gdb) print *dom
$1 = {name = 0x6f72502061746144

,
provider = 0x6f43207265646976
,
timeout = 1734960750, enumerate = 1952543349, fqnames = 105, legacy = 111,
mpg = 110, id_min = 0, id_max = 0, cache_credentials = false,
legacy_passwords = false, next = 0x21}
}}}
status: new => assigned

Fixed by [673c2ce9b3371241de872b2bd206f732485888cb]

fixedin: => 0.5.0
resolution: => fixed
status: assigned => closed

Fields changed

rhbz: => 0

Metadata Update from @sgallagh:
- Issue assigned to sgallagh
- Issue set to the milestone: Iteration 5

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1105

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata