#2829 collapse_srv_lookups frees fo_server structure that is returned by fail over API
Closed: Fixed Opened by jhrozek.

The fail-over API returns fo_server structure:

int fo_resolve_service_recv(struct tevent_req *req,
                            struct fo_server **server);

But the fo_server only points to a structure inside failover. At the same time, the collapse_srv_lookup frees the server if the TTL timeout has been reached. If another request still points to the previous fo_server, this would lead to use-after-free situations.

We should consider using something like reference counting.


Fields changed

description: The fail-over API returns fo_server structure:
{{{
int fo_resolve_service_recv(struct tevent_req req,
struct fo_server
*server);
}}}

But the fo_server only points to a structure inside failover. At the same time, the collapse_srv_lookup frees the server if the TTL timeout has been reached. If another request still owns the previous fo_server, this would lead to use-after-free situations.

We should consider using something like reference counting. => The fail-over API returns fo_server structure:
{{{
int fo_resolve_service_recv(struct tevent_req req,
struct fo_server
*server);
}}}

But the fo_server only points to a structure inside failover. At the same time, the collapse_srv_lookup frees the server if the TTL timeout has been reached. If another request still points to the previous fo_server, this would lead to use-after-free situations.

We should consider using something like reference counting.

Fields changed

summary: collapse_srv_lookups frees fo_server structure that is returned y fail over API => collapse_srv_lookups frees fo_server structure that is returned by fail over API

Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=1270558 (Red Hat Enterprise Linux 5)

rhbz: => [https://bugzilla.redhat.com/show_bug.cgi?id=1270558 1270558]

Fields changed

owner: somebody => jhrozek
patch: 0 => 1
status: new => assigned

The patch is available, but since the bug was there since 2010 and the patch is risky, I would prefer to only fix the bug in master.

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.14 alpha

  • master:
    • 10c07e188323a2f9824b5e34379f3b1a9b37759e
    • 4a4af8e1b6a9bab7c7a34d86055a400376e3829e
    • 63af9215ea9114062fd87003161e6b5982bf9b1f

resolution: => fixed
status: assigned => closed

master: acd615cffd144b69e2558a0fc45c6966423f2d02

master: a92f68763a57b211a1bf6b80b6dd80c4a1aa2738

sssd-1-13:

  • bbfc3a4294c6a70426171e080c27c15d9706bec7
  • d0baabaa4e86ef2cf899be5f1369e294688c4b8a
  • c532290fb1a85a63c3bc9ef95ba7d6248f0e94c1
  • 383bdbe8d40cba2d0848b2256716358c7f8e8f2d
  • 5d485ce42a4d56581d44c7224e78083a4ff1e81b

milestone: SSSD 1.14 alpha => SSSD 1.13.4

Metadata Update from @jhrozek:
- Issue assigned to jhrozek
- Issue set to the milestone: SSSD 1.13.4

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3870

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata