#2829 collapse_srv_lookups frees fo_server structure that is returned by fail over API
Closed: Fixed None Opened 5 years ago by jhrozek.

The fail-over API returns fo_server structure:

int fo_resolve_service_recv(struct tevent_req *req,
                            struct fo_server **server);

But the fo_server only points to a structure inside failover. At the same time, the collapse_srv_lookup frees the server if the TTL timeout has been reached. If another request still points to the previous fo_server, this would lead to use-after-free situations.

We should consider using something like reference counting.


Fields changed

description: The fail-over API returns fo_server structure:
{{{
int fo_resolve_service_recv(struct tevent_req req,
struct fo_server
*server);
}}}

But the fo_server only points to a structure inside failover. At the same time, the collapse_srv_lookup frees the server if the TTL timeout has been reached. If another request still owns the previous fo_server, this would lead to use-after-free situations.

We should consider using something like reference counting. => The fail-over API returns fo_server structure:
{{{
int fo_resolve_service_recv(struct tevent_req req,
struct fo_server
*server);
}}}

But the fo_server only points to a structure inside failover. At the same time, the collapse_srv_lookup frees the server if the TTL timeout has been reached. If another request still points to the previous fo_server, this would lead to use-after-free situations.

We should consider using something like reference counting.

Fields changed

summary: collapse_srv_lookups frees fo_server structure that is returned y fail over API => collapse_srv_lookups frees fo_server structure that is returned by fail over API

Fields changed

owner: somebody => jhrozek
patch: 0 => 1
status: new => assigned

The patch is available, but since the bug was there since 2010 and the patch is risky, I would prefer to only fix the bug in master.

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.14 alpha

resolution: => fixed
status: assigned => closed

sssd-1-13:

milestone: SSSD 1.14 alpha => SSSD 1.13.4

Metadata Update from @jhrozek:
- Issue assigned to jhrozek
- Issue set to the milestone: SSSD 1.13.4

3 years ago

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3870

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Login to comment on this ticket.

Metadata