freeipa

#9906 ipa-otpd crash on passkey auth
Closed: fixed by rjeffman. Opened by jstephen.

Closed: fixed
Reopen Issue

Issue

ipa-otpd crashes on F43 IPA server when attempting passkey auth from F42 IPA client.

Steps to Reproduce

  1. ipa user-add pkuser --user-auth-type=passkey
  2. ipa user-add-passkey pkuser --register
  3. su - pkuser

Actual behavior

ipa-otpd crashes

Expected behavior

Successful passkey auth

Version/Release/Distribution

Fedora 42 client, joined to a Fedora 43 IPA server of https://github.com/sssd/sssd-ci-containers environment.
freeipa-server-4.13.0-2.fc43.x86_64

Additional info:

This auth flow was working fine previously with the same setup.

I can reproduce this easily if any additional information is needed.

-- journal

Dec 18 19:26:14 master.ipa.test /mod_wsgi[402]: [🡕] [IPA.API] admin@IPA.TEST: user_add_passkey: SUCCESS [ldap2_139980070288896] {"uid": "pkuser", "ipapasskey": ["passke>
Dec 18 19:26:26 master.ipa.test systemd[1]: Created slice system-ipa\x2dotpd.slice - Slice /system/ipa-otpd.
Dec 18 19:26:26 master.ipa.test systemd[1]: Started ipa-otpd@0-4100-334_3407678-0.service - ipa-otpd service (PID 334/UID 0).
Dec 18 19:26:26 master.ipa.test ipa-otpd[1073]: LDAP: ldapi://%2Frun%2Fslapd-IPA-TEST.socket
Dec 18 19:26:26 master.ipa.test ipa-otpd[1073]: pkuser@IPA.TEST: request received
Dec 18 19:26:26 master.ipa.test ipa-otpd[1073]: pkuser@IPA.TEST: user query start
Dec 18 19:26:26 master.ipa.test ipa-otpd[1073]: pkuser@IPA.TEST: user query end: uid=pkuser,cn=users,cn=accounts,dc=ipa,dc=test
Dec 18 19:26:26 master.ipa.test ipa-otpd[1073]: pkuser@IPA.TEST: passkey config query start:
Dec 18 19:26:26 master.ipa.test ipa-otpd[1073]: pkuser@IPA.TEST: passkey query end: ok
Dec 18 19:26:26 master.ipa.test ipa-otpd[1073]: pkuser@IPA.TEST: sent: 0 data: 306
Dec 18 19:26:26 master.ipa.test ipa-otpd[1073]: pkuser@IPA.TEST: ..sent: 306 data: 306
Dec 18 19:26:26 master.ipa.test ipa-otpd[1073]: pkuser@IPA.TEST: response sent: Access-Challenge
Dec 18 19:26:26 master.ipa.test ipa-otpd[1073]: Socket closed, shutting down...
Dec 18 19:26:26 master.ipa.test ipa-otpd[1073]: malloc(): unsorted double linked list corrupted
Dec 18 19:26:26 master.ipa.test systemd[1]: ipa-otpd@0-4100-334_3407678-0.service: Main process exited, code=dumped, status=6/ABRT
Dec 18 19:26:26 master.ipa.test systemd[1]: ipa-otpd@0-4100-334_3407678-0.service: Failed with result 'core-dump'.

-- coredump bt

Downloading source file /usr/src/debug/glibc-2.42-5.fc43.x86_64/nptl/pthread_kill.c

0 __pthread_kill_implementation (threadid=, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44

44 return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO (ret) : 0;
(gdb) where

0 __pthread_kill_implementation (threadid=, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44

1 0x00007f5fa0f50493 in __pthread_kill_internal (threadid=, signo=6) at pthread_kill.c:89

2 0x00007f5fa0ef615e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26

3 0x00007f5fa0edd6d0 in __GI_abort () at abort.c:77

4 0x00007f5fa0ede73b in __libc_message_impl (fmt=fmt@entry=0x7f5fa10907ea "%s\n") at ../sysdeps/posix/libc_fatal.c:138

5 0x00007f5fa0f5a665 in malloc_printerr (str=str@entry=0x7f5fa1093d80 "malloc(): unsorted double linked list corrupted") at malloc.c:5892

6 0x00007f5fa0f5d9ec in _int_malloc (av=av@entry=0x7f5fa10c5ac0 , bytes=bytes@entry=4060) at malloc.c:4219

7 0x00007f5fa0f5e31f in __libc_malloc2 (bytes=4060) at malloc.c:3450

8 0x00007f5fa0e2ed8d in ber_memalloc_x (s=s@entry=4060, ctx=)

at /usr/src/debug/openldap-2.6.10-4.fc43.x86_64/openldap-2.6.10/libraries/liblber/memory.c:228

9 0x00007f5fa0e2f9a3 in ber_memrealloc_x (p=p@entry=0x0, s=s@entry=4060, ctx=)

at /usr/src/debug/openldap-2.6.10-4.fc43.x86_64/openldap-2.6.10/libraries/liblber/memory.c:310

10 0x00007f5fa0e2fa5d in ber_realloc (ber=ber@entry=0x559f18c57410, len=7, len@entry=6)

at /usr/src/debug/openldap-2.6.10-4.fc43.x86_64/openldap-2.6.10/libraries/liblber/io.c:170

11 0x00007f5fa0e2fb9b in ber_start_seqorset (ber=0x559f18c57410, tag=)

at /usr/src/debug/openldap-2.6.10-4.fc43.x86_64/openldap-2.6.10/libraries/liblber/encode.c:397

12 0x00007f5fa0e2fbd6 in ber_start_seq (ber=, tag=)

at /usr/src/debug/openldap-2.6.10-4.fc43.x86_64/openldap-2.6.10/libraries/liblber/encode.c:420

13 0x00007f5fa0e3034d in ber_printf (ber=ber@entry=0x559f18c57410, fmt=, fmt@entry=0x7f5fa1122c3c "{itn")

at /usr/src/debug/openldap-2.6.10-4.fc43.x86_64/openldap-2.6.10/libraries/liblber/encode.c:620

14 0x00007f5fa10df55f in ldap_send_unbind (cctrls=, ld=0x559f18bfee80, sb=0x559f18bff4c0, sctrls=0x0)

at /usr/src/debug/openldap-2.6.10-4.fc43.x86_64/openldap-2.6.10/libraries/libldap/unbind.c:293

15 ldap_send_unbind (ld=0x559f18bfee80, sb=0x559f18bff4c0, sctrls=0x0, cctrls=)

at /usr/src/debug/openldap-2.6.10-4.fc43.x86_64/openldap-2.6.10/libraries/libldap/unbind.c:270

16 0x00007f5fa10f03b5 in ldap_free_connection (ld=0x559f18bfee80, lc=0x559f18bff5c0, force=1, unbind=1)

at /usr/src/debug/openldap-2.6.10-4.fc43.x86_64/openldap-2.6.10/libraries/libldap/request.c:792

17 0x00007f5fa10e5650 in ldap_ld_free (ld=0x559f18bfee80, close=1, sctrls=, cctrls=)

at /usr/src/debug/openldap-2.6.10-4.fc43.x86_64/openldap-2.6.10/libraries/libldap/unbind.c:118

18 0x00007f5fa1760676 in verto_del (ev=0x559f18c04820) at /usr/src/debug/libverto-0.3.2-11.fc43.x86_64/src/verto.c:910

19 verto_del (ev=0x559f18c04820) at /usr/src/debug/libverto-0.3.2-11.fc43.x86_64/src/verto.c:895

20 0x00007f5fa176078b in verto_free (ctx=0x559f18bf3a30) at /usr/src/debug/libverto-0.3.2-11.fc43.x86_64/src/verto.c:599

21 verto_free (ctx=0x559f18bf3a30) at /usr/src/debug/libverto-0.3.2-11.fc43.x86_64/src/verto.c:584

22 0x0000559eea0d94e0 in main (argc=, argv=0x7ffd5f309a88) at /usr/src/debug/freeipa-4.13.0-2.fc43.x86_64/daemons/ipa-otpd/main.c:416

This sounds like a regression in openldap during unbind.

Can you open a big against openldap in Fedora?

I filed https://bugzilla.redhat.com/show_bug.cgi?id=2423867

I tried downgrading openldap packages to openldap-2.6.9-5.fc43.x86_64 and 'ipactl restart' but the crash still occurs
Edited by jstephen

PR: https://github.com/freeipa/freeipa/pull/8102

Metadata Update from @abbra:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/8102
- Issue assigned to sbose

master:

  • bcd6e9a2f2fe4e56f429da3ceb06b21f020e3dce ipa-otpd: do not pass reference of data_out->jdata

ipa-4-11:

  • 45077f5795b73571475947c665b17ae250fd46df ipa-otpd: do not pass reference of data_out->jdata

ipa-4-13:

  • 5f7bd9612edd5ab6b8cd45148be75b3fd7c86cf8 ipa-otpd: do not pass reference of data_out->jdata

ipa-4-12:

  • 4d5289101543865e114bdc65ff9551e7e58054ca ipa-otpd: do not pass reference of data_out->jdata

Metadata Update from @rjeffman:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.