#598 sss client causes sig bus in pppd
Closed: Invalid None Opened 13 years ago by simo.

Tested with both 1.2.1 and 1.2.2 (updates-testing for F13).

Simply having nss_sss enabled in /etc/nsswitch.conf causes pppd to segfault on startup with SIGBUS.

The trace shows the SIGBUS happens in the glibc getent() function, called by sss_nss_make_request().

Program terminated with signal 7, Bus error.
#0  getenv (name=0x7f0f3e41ee6c "SS_LOOPS") at getenv.c:90
90        if (name_start == ep_start && !strncmp (*ep + 2, name, len)
Missing separate debuginfos, use: debuginfo-install ppp-2.4.5-9.fc13.x86_64
(gdb) bt
#0  getenv (name=0x7f0f3e41ee6c "SS_LOOPS") at getenv.c:90
#1  0x00007f0f3e41dbc7 in sss_nss_make_request (cmd=SSS_NSS_GETPWUID, rd=0x7fff979873f0, repbuf=0x7fff97987410, replen=0x7fff97987408, errnop=0x7f0f426d26a8) at sss_client/common.c:644
#2  0x00007f0f3e41e23d in _nss_sss_getpwuid_r (uid=<value optimized out>, result=0x7fff97988100, buffer=0x7fff97987cd0 "usbmuxd", buflen=2048, errnop=0x7f0f426d26a8) at sss_client/passwd.c:244
#3  0x00007f0f41778dfd in __getpwuid_r (uid=4294967295, resbuf=0x7fff97988100, buffer=0x7fff97987cd0 "usbmuxd", buflen=2048, result=0x7fff97988140) at ../nss/getXXbyYY_r.c:253
#4  0x00007f0f4177b0cd in __getlogin_r_loginuid (name=0x7f0f41a4ee40 "", namesize=33) at ../sysdeps/unix/sysv/linux/getlogin_r.c:63
#5  0x00007f0f4177add5 in getlogin () at ../sysdeps/unix/sysv/linux/getlogin.c:35
#6  0x00007f0f427083d2 in main ()

There's something wrong with that backtrace. In {{{sss_nss_make_request()}}} we call

getenv("_SSS_LOOPS");

For some reason, getenv.c seems to be receiving "SS_LOOPS" for the name instead. This seems like it's a memory corruption issue of some kind.

Ok, this happens when nsswitch.conf is configured, but SSSD is not running.

We need to ensure that if SSSD is not running, we handle it gracefully in the sss_client code.

Raising priority.

component: SSSD => NSS
milestone: NEEDS_TRIAGE => SSSD 1.2.3
owner: somebody => sgallagh
priority: critical => blocker
status: new => assigned

This bug can be trivially reproduced with the following code:

#include <unistd.h>
#include <stdio.h>

int main(int argc, char **argv)
{
    char *username = getlogin();

    printf("[%s]\n", username);
    return 0;
}

This is a bug in glibc, not SSSD. We're behaving correctly here.

https://bugzilla.redhat.com/show_bug.cgi?id=621959

resolution: => wontfix
status: assigned => closed

Metadata Update from @simo:
- Issue assigned to sgallagh
- Issue set to the milestone: SSSD 1.2.3

7 years ago

Metadata Update from @jhrozek:
- Custom field rhbz adjusted to 0

7 years ago

Metadata Update from @jhrozek:
- Custom field rhbz adjusted to 0

7 years ago

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1640

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Login to comment on this ticket.

Metadata