1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-22 13:34:15 +03:00
https://gitlab.com/samba-team/samba is the Official GitLab mirror of https://git.samba.org/samba.git -- Merge requests should be made on GitLab (not on GitHub)
Go to file
Volker Lendecke 104fcaa89f ctdb: Fix a use-after-free in run_proc
If you happen to talloc_free(run_ctx) before all the tevent_req's
hanging off it, you run into the following:

==495196== Invalid read of size 8
==495196==    at 0x10D757: run_proc_state_destructor (run_proc.c:413)
==495196==    by 0x488F736: _tc_free_internal (talloc.c:1158)
==495196==    by 0x488FBDD: _talloc_free_internal (talloc.c:1248)
==495196==    by 0x4890F41: _talloc_free (talloc.c:1792)
==495196==    by 0x48538B1: tevent_req_received (tevent_req.c:293)
==495196==    by 0x4853429: tevent_req_destructor (tevent_req.c:129)
==495196==    by 0x488F736: _tc_free_internal (talloc.c:1158)
==495196==    by 0x4890AF6: _tc_free_children_internal (talloc.c:1669)
==495196==    by 0x488F967: _tc_free_internal (talloc.c:1184)
==495196==    by 0x488FBDD: _talloc_free_internal (talloc.c:1248)
==495196==    by 0x4890F41: _talloc_free (talloc.c:1792)
==495196==    by 0x10DE62: main (run_proc_test.c:86)
==495196==  Address 0x55b77f8 is 152 bytes inside a block of size 160 free'd
==495196==    at 0x48399AB: free (vg_replace_malloc.c:538)
==495196==    by 0x488FB25: _tc_free_internal (talloc.c:1222)
==495196==    by 0x488FBDD: _talloc_free_internal (talloc.c:1248)
==495196==    by 0x4890F41: _talloc_free (talloc.c:1792)
==495196==    by 0x10D315: run_proc_context_destructor (run_proc.c:329)
==495196==    by 0x488F736: _tc_free_internal (talloc.c:1158)
==495196==    by 0x488FBDD: _talloc_free_internal (talloc.c:1248)
==495196==    by 0x4890F41: _talloc_free (talloc.c:1792)
==495196==    by 0x10DE62: main (run_proc_test.c:86)
==495196==  Block was alloc'd at
==495196==    at 0x483877F: malloc (vg_replace_malloc.c:307)
==495196==    by 0x488EAD9: __talloc_with_prefix (talloc.c:783)
==495196==    by 0x488EC73: __talloc (talloc.c:825)
==495196==    by 0x488F0FC: _talloc_named_const (talloc.c:982)
==495196==    by 0x48925B1: _talloc_zero (talloc.c:2421)
==495196==    by 0x10C8F2: proc_new (run_proc.c:61)
==495196==    by 0x10D4C9: run_proc_send (run_proc.c:381)
==495196==    by 0x10DDF6: main (run_proc_test.c:79)

This happens because run_proc_context_destructor() directly does a
talloc_free() on the struct proc_context's and not the enclosing
tevent_req's. run_proc_kill() makes sure that we don't follow
proc->req, but it forgets the "state->proc", which is free()'ed, but
later dereferenced in run_proc_state_destructor().

This is an attempt at a quick fix, I believe we should convert
run_proc_context->plist into an array of tevent_req's, so that we can
properly TALLOC_FREE() according to the "natural" hierarchy and not
just pull an arbitrary thread out of that heap.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15269

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Oct  6 15:10:20 UTC 2022 on sn-devel-184

(cherry picked from commit 688be0177b)
2023-01-03 18:21:10 +00:00
.github Added redirect from GitHub to GitLab 2018-12-05 16:35:33 +01:00
auth CVE-2022-2031 auth: Add ticket type field to auth_user_info_dc and auth_session_info 2022-07-24 09:23:56 +02:00
bootstrap bootstrap: use compat-gnutls37-devel for centos7 2022-01-21 20:46:35 +00:00
buildtools CVE-2022-37966 wafsamba: add support for CHECK_VARIABLE(mandatory=True) 2022-12-14 10:28:16 +00:00
coverity
ctdb ctdb: Fix a use-after-free in run_proc 2023-01-03 18:21:10 +00:00
dfs_server lib/util: remove extra safe_string.h file 2020-08-28 02:18:40 +00:00
docs-xml CVE-2022-37966 samba-tool: add 'domain trust modify' command 2022-12-14 10:28:17 +00:00
dynconfig dynconfig: Introduce and expose SAMBA_LIBEXECDIR 2021-04-01 19:32:36 +00:00
examples s3:rpc_client: Pass remote name and socket to cli_rpc_pipe_open_noauth_transport() 2021-12-02 13:59:31 +00:00
file_server s3: Remove --log-stdout from daemons 2021-04-29 03:58:37 +00:00
include
lib CVE-2022-37966 param: Add support for new option "kdc supported enctypes" 2022-12-14 10:28:17 +00:00
libcli CVE-2022-37966 libcli/auth: let netlogon_creds_cli_warn_options() about "kerberos encryption types=legacy" 2022-12-14 10:28:16 +00:00
libds/common CVE-2020-25717: Add FreeIPA domain controller role 2021-11-09 19:45:33 +00:00
libgpo gp: Add Firewalld ADMX templates 2021-11-01 20:29:36 +00:00
librpc CVE-2022-37966 drsuapi.idl: add trustedDomain related ATTID values 2022-12-14 10:28:17 +00:00
nsswitch nsswitch: Fix uninitialized memory when allocating pwdlastset_prelim 2022-11-23 13:52:37 +00:00
packaging winbind.service: drop quotes from $WINBINDOPTIONS variable 2020-05-12 12:27:11 +00:00
pidl rpc_server3: Remove pipes_struct->auth 2022-01-05 00:11:38 +00:00
python CVE-2022-37966 python:/tests/krb5: call sys.path.insert(0, "bin/python") before any other imports 2022-12-14 11:34:00 +00:00
release-scripts
script autobuild: Fix path for libwbclient ldd checks 2022-01-20 14:19:02 +00:00
selftest CVE-2022-37966 s4:kdc: announce PA-SUPPORTED-ETYPES like windows. 2022-12-14 10:28:17 +00:00
source3 CVE-2022-37966 param: let "kdc default domain supportedenctypes = 0" mean the default 2022-12-14 10:28:17 +00:00
source4 CVE-2022-37966 s4:kdc: apply restrictions of "kdc supported enctypes" 2022-12-14 10:28:17 +00:00
testdata pytest/source_char: check for mixed direction text 2021-12-03 18:53:43 +00:00
testprogs CVE-2022-2031 testprogs: Add test for short-lived ticket across an incoming trust 2022-07-24 09:23:56 +02:00
tests readlink test: inverse return code 2022-02-27 19:08:16 +00:00
testsuite s3:rpc_server: Activate samba-dcerpcd 2021-12-10 14:02:30 +00:00
third_party CVE-2022-37966 kdc: Implement new Kerberos session key behaviour since ENC_HMAC_SHA1_96_AES256_SK was added 2022-12-14 10:28:16 +00:00
wintest wintest: py3 telnet.sendline() doesn't like string with ^Z 2019-07-02 04:21:36 +00:00
.bzrignore
.editorconfig HEIMDAL: move code from source4/heimdal* to third_party/heimdal* 2022-01-19 21:41:59 +00:00
.gitattributes gitattributes: Ignore .SAMBABACKUP files 2018-08-16 23:42:22 +02:00
.gitignore gitignore: Add .cache directory 2021-07-19 15:27:14 +00:00
.gitlab-ci-coverage-runners.yml add .gitlab-ci-coverage.yml for a scheduled build 2021-04-13 09:33:14 +00:00
.gitlab-ci-coverage.yml add .gitlab-ci-coverage.yml for a scheduled build 2021-04-13 09:33:14 +00:00
.gitlab-ci-default-runners.yml .gitlab-ci*.yml: only use gitlab.org shared runners if possible 2021-04-13 08:23:35 +00:00
.gitlab-ci-default.yml .gitlab-ci.yml: Honour AUTOBUILD_SKIP_SAMBA_O3 in GitLab CI 2021-10-13 11:10:44 +00:00
.gitlab-ci-main.yml bootstrap: use compat-gnutls37-devel for centos7 2022-01-21 20:46:35 +00:00
.gitlab-ci-private.yml .gitlab-ci.yml: move the content to .gitlab-ci-main.yml 2021-04-13 08:23:35 +00:00
.gitlab-ci.yml .gitlab-ci.yml: move the content to .gitlab-ci-main.yml 2021-04-13 08:23:35 +00:00
.testr.conf
.ycm_extra_conf.py PEP8: fix E302: expected 2 blank lines, found 1 2018-08-24 07:49:29 +02:00
callcatcher-exceptions.grep
configure configure: allow configure script to accept parameters with spaces 2021-09-09 00:53:54 +00:00
configure.developer
COPYING
GPG_AA99442FB680B620_replaces_6F33915B6568B7EA.txt ReleaseKey: add GnuPG key transition statement for the Samba release key 2021-01-21 13:57:45 +01:00
Makefile Makefile: add support for 'make testonly' 2021-01-27 09:56:29 +00:00
PFIF.txt docs: protocolfreedom.org is no longer 2020-06-12 22:11:43 +00:00
README.cifs-utils
README.Coding.md README.Coding: target Python 3.6+ 2020-08-03 04:13:37 +00:00
README.contributing Rename Samba's DCO to Samba Developer's Declaration 2020-10-20 22:54:01 +00:00
README.md Update README.md with more up to date information 2020-06-12 22:11:43 +00:00
SECURITY.md Update SECURITY.md to point to security releases 2020-06-03 15:55:10 +00:00
setup.cfg pep8 tidy up config 2020-12-17 00:54:51 +00:00
VERSION VERSION: Bump version up to Samba 4.16.9... 2022-12-15 17:04:23 +01:00
VFS-License-clarification.txt VFS-License-clarification: minor improvements aligning w/ GPLv3 text 2020-11-04 21:29:40 +00:00
WHATSNEW.txt WHATSNEW: Add release notes for Samba 4.16.8. 2022-12-15 17:03:15 +01:00
wscript wscript: fix installing pre-commit with 'git worktree' 2021-08-12 08:56:13 +00:00
wscript_build s4:lib: Remove obsolete popt cmdline parser 2021-06-20 23:26:32 +00:00
wscript_build_embedded_heimdal wafsamba: Remove clangdb code which doesn't work 2022-01-21 23:33:36 +00:00
wscript_build_system_heimdal wafsamba: Remove clangdb code which doesn't work 2022-01-21 23:33:36 +00:00
wscript_build_system_mitkrb5 wafsamba: Remove clangdb code which doesn't work 2022-01-21 23:33:36 +00:00
wscript_configure_embedded_heimdal HEIMDAL: move code from source4/heimdal* to third_party/heimdal* 2022-01-19 21:41:59 +00:00
wscript_configure_system_gnutls libcli/smb: let smb2_signing_decrypt_pdu() cope with gnutls_aead_cipher_decrypt() ptext_len bug 2022-02-13 10:18:29 +00:00
wscript_configure_system_heimdal HEIMDAL: move code from source4/heimdal* to third_party/heimdal* 2022-01-19 21:41:59 +00:00
wscript_configure_system_mitkrb5 CVE-2022-37966 system_mitkrb5: require support for aes enctypes 2022-12-14 10:28:16 +00:00

About Samba

Samba is the standard Windows interoperability suite of programs for Linux and Unix. Samba is Free Software licensed under the GNU General Public License and the Samba project is a member of the Software Freedom Conservancy. Since 1992, Samba has provided secure, stable and fast file and print services for all clients using the SMB/CIFS protocol, such as all versions of DOS and Windows, OS/2, Linux and many others. Samba is an important component to seamlessly integrate Linux/Unix Servers and Desktops into Active Directory environments. It can function both as a domain controller or as a regular domain member.

For the AD DC implementation a full HOWTO is provided at: https://wiki.samba.org/index.php/Samba4/HOWTO

Community guidelines can be read at: https://wiki.samba.org/index.php/How_to_do_Samba:_Nicely

This software is freely distributable under the GNU public license, a copy of which you should have received with this software (in a file called COPYING).

CONTRIBUTIONS

Please see https://wiki.samba.org/index.php/Contribute for detailed set-by-step instructions on how to submit a patch for Samba via GitLab.

Samba's GitLab mirror is at https://gitlab.com/samba-team/samba

OUR CONTRIBUTORS

See https://www.samba.org/samba/team/ for details of the Samba Team, as well as details of all those currently active in Samba development.

If you like a particular feature then look through the git change-log (on the web at https://gitweb.samba.org/?p=samba.git;a=summary) and see who added it, then send them an email.

Remember that free software of this kind lives or dies by the response we get. If no one tells us they like it then we'll probably move onto something else.

MORE INFO

DOCUMENTATION

There is quite a bit of documentation included with the package, including man pages and the wiki at https://wiki.samba.org

If you would like to help with our documentation, please contribute that improved content to the wiki, we are moving as much content there as possible.

MAILING LIST

Please do NOT send subscription/unsubscription requests to the lists!

There is a mailing list for discussion of Samba. For details go to https://lists.samba.org/ or send mail to samba-subscribe@lists.samba.org

There is also an announcement mailing list where new versions are announced. To subscribe go to https://lists.samba.org/ or send mail to samba-announce-subscribe@lists.samba.org. All announcements also go to the samba list, so you only need to be on one.

For details of other Samba mailing lists and for access to archives, see https://lists.samba.org/

MAILING LIST ETIQUETTE

A few tips when submitting to this or any mailing list.

  1. Make your subject short and descriptive. Avoid the words "help" or "Samba" in the subject. The readers of this list already know that a) you need help, and b) you are writing about samba (of course, you may need to distinguish between Samba PDC and other file sharing software). Avoid phrases such as "what is" and "how do i". Some good subject lines might look like "Slow response with Excel files" or "Migrating from Samba PDC to NT PDC".

  2. If you include the original message in your reply, trim it so that only the relevant lines, enough to establish context, are included. Chances are (since this is a mailing list) we've already read the original message.

  3. Trim irrelevant headers from the original message in your reply. All we need to see is a) From, b) Date, and c) Subject. We don't even really need the Subject, if you haven't changed it. Better yet is to just preface the original message with "On [date] [someone] wrote:".

  4. Please don't reply to or argue about spam, spam filters or viruses on any Samba lists. We do have a spam filtering system that is working quite well thank you very much but occasionally unwanted messages slip through. Deal with it.

  5. Never say "Me too." It doesn't help anyone solve the problem. Instead, if you ARE having the same problem, give more information. Have you seen something that the other writer hasn't mentioned, which may be helpful?

  6. If you ask about a problem, then come up with the solution on your own or through another source, by all means post it. Someone else may have the same problem and is waiting for an answer, but never hears of it.

  7. Give as much relevant information as possible such as Samba release number, OS, kernel version, etc...

  8. RTFM. Google.

WEBSITE

A Samba website has been setup with lots of useful info. Connect to:

https://www.samba.org/

As well as general information and documentation, this also has searchable archives of the mailing list and links to other useful resources such as the wiki.