sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-01 05:47:28 +03:00
Code
samba-mirror/source3/lib
History
Noel Power af00a0df70 s3/lib: Prevent use after free of messaging_ctdb_fde_ev structs 
In a cluster setup samba-bgqd async callback
cups_pcap_load_async can access messaging_ctdb_fde_ev associated
with already destructed global_ctdb_ctx_destructor

==26053== Invalid read of size 8
==26053==    at 0x71692E1: messaging_ctdb_fde_ev_destructor (messages_ctdb.c:181)
==26053==    by 0x40B2309: _tc_free_internal (talloc.c:1158)
==26053==    by 0x40B3539: _tc_free_children_internal (talloc.c:1669)
==26053==    by 0x40B24C4: _tc_free_internal (talloc.c:1184)
==26053==    by 0x40B3539: _tc_free_children_internal (talloc.c:1669)
==26053==    by 0x40B24C4: _tc_free_internal (talloc.c:1184)
==26053==    by 0x40B2685: _talloc_free_internal (talloc.c:1248)
==26053==    by 0x40B3963: _talloc_free (talloc.c:1792)
==26053==    by 0x4056BCA: tevent_req_received (tevent_req.c:301)
==26053==    by 0x405673D: tevent_req_destructor (tevent_req.c:135)
==26053==    by 0x40B2309: _tc_free_internal (talloc.c:1158)
==26053==    by 0x40B3539: _tc_free_children_internal (talloc.c:1669)
==26053==    by 0x40B24C4: _tc_free_internal (talloc.c:1184)
==26053==    by 0x40B2685: _talloc_free_internal (talloc.c:1248)
==26053==    by 0x40B3963: _talloc_free (talloc.c:1792)
==26053==    by 0x1384EF: cups_pcap_load_async (print_cups.c:507)
==26053==    by 0x13894B: cups_cache_reload (print_cups.c:602)
==26053==    by 0x1373AE: pcap_cache_reload (pcap.c:140)
==26053==    by 0x1369D2: register_printing_bq_handlers (queue_process.c:323)
==26053==    by 0x122AD6: main (samba-bgqd.c:316)
==26053==  Address 0xed64d48 is 120 bytes inside a block of size 128 free'd
==26053==    at 0x4C370EB: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==26053==    by 0x40B25E1: _tc_free_internal (talloc.c:1222)
==26053==    by 0x40B2685: _talloc_free_internal (talloc.c:1248)
==26053==    by 0x40B3963: _talloc_free (talloc.c:1792)
==26053==    by 0x71691F6: messaging_ctdb_destroy (messages_ctdb.c:141)
==26053==    by 0x7169C21: msg_ctdb_ref_destructor (messages_ctdb_ref.c:142)
==26053==    by 0x40B2309: _tc_free_internal (talloc.c:1158)
==26053==    by 0x40B3539: _tc_free_children_internal (talloc.c:1669)
==26053==    by 0x40B24C4: _tc_free_internal (talloc.c:1184)
==26053==    by 0x40B2685: _talloc_free_internal (talloc.c:1248)
==26053==    by 0x40B3963: _talloc_free (talloc.c:1792)
==26053==    by 0x4157380: messaging_reinit (messages.c:646)
==26053==    by 0x416C01E: reinit_after_fork (util.c:488)
==26053==    by 0x13844C: cups_pcap_load_async (print_cups.c:498)
==26053==    by 0x13894B: cups_cache_reload (print_cups.c:602)
==26053==    by 0x1373AE: pcap_cache_reload (pcap.c:140)
==26053==    by 0x1369D2: register_printing_bq_handlers (queue_process.c:323)
==26053==    by 0x122AD6: main (samba-bgqd.c:316)
==26053==  Block was alloc'd at
==26053==    at 0x4C346A4: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==26053==    by 0x40B1989: __talloc_with_prefix (talloc.c:783)
==26053==    by 0x40B1B23: __talloc (talloc.c:825)
==26053==    by 0x40B1ECC: _talloc_named_const (talloc.c:982)
==26053==    by 0x40B49C3: _talloc_zero (talloc.c:2421)
==26053==    by 0x7168E68: messaging_ctdb_init (messages_ctdb.c:93)
==26053==    by 0x716979D: messaging_ctdb_ref (messages_ctdb_ref.c:75)
==26053==    by 0x415702A: messaging_init_internal (messages.c:563)
==26053==    by 0x41572FD: messaging_init (messages.c:622)
==26053==    by 0x4163ED3: global_messaging_context (global_contexts.c:62)
==26053==    by 0x12273B: main (samba-bgqd.c:271)
==26053==

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15293

Signed-off-by: Noel Power <npower@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 7a880ef52dfc85ed2f674250b5baf5109f8d4691)

Autobuild-User(v4-18-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-18-test): Tue Jan 31 12:49:50 UTC 2023 on atb-devel-224
2023-01-31 12:49:50 +00:00
..
ABI
Decouple ldap-ssl-ads from ldap-ssl option
2020-07-13 10:41:37 +00:00
dbwrap
s3:g_lock: add callback function to g_lock_lock()
2022-09-20 00:34:35 +00:00
eventlog
lib: Use dom_sid_str_buf
2018-12-11 00:40:30 +01:00
netapi
s3-librpc: add ads.idl and convert ads_struct to talloc.
2022-12-16 20:38:32 +00:00
smbconf
source3/lib/smbconf: add python bindings for init functions
2022-05-06 17:16:30 +00:00
addrchange.c
s3/lib: clang: 'Value stored to 'rta' is never read'
2019-07-16 22:52:25 +00:00
addrchange.h
…
adouble.c
smbd: Pass vfs_open_how through fd_openat
2022-08-06 01:43:50 +00:00
adouble.h
CVE-2021-44142: libadouble: add defines for icon lengths
2022-01-31 15:27:37 +00:00
adt_tree.c
lib: Whitespace fixes
2022-10-27 18:18:36 +00:00
audit.c
s3:lib: Use C99 initializer for audit_category_tab
2019-01-28 10:29:23 +01:00
avahi.c
…
background.c
smbd: remove process shortname arg from reinit_after_fork()
2022-12-14 01:38:29 +00:00
background.h
lib: Add required includes to source3/lib/background.h
2021-04-01 19:32:36 +00:00
cbuf.c
lib: Remove an #include "includes.h"
2018-07-24 20:36:49 +02:00
cbuf.h
Fix spelling s/formated/formatted/
2018-05-12 02:09:26 +02:00
charcnv.c
s3:lib:charcnv: Remove use of global global_iconv_handle
2017-04-18 11:47:17 +02:00
cleanupdb.c
lib: Avoid an #include includes.h
2022-10-27 18:18:36 +00:00
cleanupdb.h
lib: Avoid an #include includes.h
2022-10-27 18:18:36 +00:00
cluster_support.c
…
cluster_support.h
…
cmdline_contexts.c
lib: give global_contexts.c its own header file
2021-01-08 20:31:33 +00:00
cmdline_contexts.h
s3:lib: Introduce cmdline context wrapper
2018-09-07 17:26:14 +02:00
ctdb_dummy.c
s3:ctdbd_conn: simplify get_public_ips() / find_in_public_ips() API
2020-10-14 12:29:55 +00:00
ctdbd_conn.c
s3:ctdbd_conn: make sure ctdbd_init_async_connection() never returns 0 with conn = NULL
2022-07-01 17:35:27 +00:00
dmallocmsg.c
…
dumpcore.c
s3/dump_core: Have a newline towards the end of log message
2019-10-18 08:54:04 +00:00
errmap_unix.c
lib: Map ERANGE to NT_STATUS_INTEGER_OVERFLOW
2022-08-19 12:43:06 +00:00
file_id.c
smbd: remove itime and file_id logic and code
2022-03-31 23:01:37 +00:00
file_id.h
smbd: remove itime and file_id logic and code
2022-03-31 23:01:37 +00:00
filename_util.c
lib: Move 16 bytes to readonly .text segment
2023-01-10 00:28:37 +00:00
fstring.c
s3-lib: restore truncating behavior of push_ascii_nstring()
2022-10-25 16:25:40 +00:00
g_lock.c
lib: Use tdb_data_dbg() where appropriate
2023-01-10 00:28:37 +00:00
gencache.c
s3:lib: Create the cache path of user gencache recursively
2021-01-06 23:59:58 +00:00
gencache.h
gencache: Remove transaction-based tdb
2018-11-06 18:57:26 +01:00
global_contexts.c
lib: give global_contexts.c its own header file
2021-01-08 20:31:33 +00:00
global_contexts.h
lib: give global_contexts.c its own header file
2021-01-08 20:31:33 +00:00
id_cache.c
s3:lib: Add missing break in switch statement
2021-02-01 21:50:32 +00:00
id_cache.h
s3-lib: remove some dead prototypes
2017-05-10 15:53:20 +02:00
idmap_cache.c
s3: safe_string: do not include string_wrappers.h
2020-08-28 00:56:34 +00:00
idmap_cache.h
lib: Remove some unused code
2019-02-28 13:53:40 +00:00
interface.c
interface: fix if_index is not parsed correctly
2020-10-14 11:07:36 +00:00
interface.h
s3:lib: Move interface prototypes to own header file
2020-10-09 20:36:12 +00:00
ldap_debug_handler.c
…
ldap_escape.c
s3:lib: Use memcpy() in escape_ldap_string()
2018-05-17 17:30:09 +02:00
lsa.c
lib: Avoid an "includes.h"
2017-02-15 02:28:16 +01:00
messages_ctdb_ref.c
s3:lib/messages*: s/getpid/tevent_cached_getpid
2022-07-25 17:34:33 +00:00
messages_ctdb_ref.h
messaging: Add messages_ctdb_ref
2017-07-25 17:43:18 +02:00
messages_ctdb.c
s3/lib: Prevent use after free of messaging_ctdb_fde_ev structs
2023-01-31 12:49:50 +00:00
messages_ctdb.h
messages_ctdb: Add messaging_ctdb_connection
2017-07-25 17:43:18 +02:00
messages_util.c
lib: Add lib/util/server_id.h
2017-01-22 18:30:11 +01:00
messages_util.h
…
messages.c
s3:lib/messages*: s/getpid/tevent_cached_getpid
2022-07-25 17:34:33 +00:00
ms_fnmatch.c
s3:lib: Fix size types in ms_fnmatch()
2018-03-21 20:43:19 +01:00
namearray.c
…
namemap_cache.c
lib: relicense smb_strtoul(l) under LGPLv3
2020-08-03 22:21:02 +00:00
namemap_cache.h
namemap_cache: Absorb the expired calculation into namemap_cache.c
2018-10-16 18:00:10 +02:00
per_thread_cwd.c
s3:lib: add per_thread_cwd_{check,supported,disable,activate}() helper functions
2019-01-11 23:11:11 +01:00
privileges.c
lib: Fix a typo in a DEBUG fn prefix by using DBG_
2021-10-08 19:28:31 +00:00
privileges.h
…
readdir_attr.h
…
recvfile.c
…
sendfile.c
lib;smbd: Fix the -Os build by initializing variables
2021-08-06 17:22:30 +00:00
server_id_db_util.c
lib: Add lib/util/server_id.h
2017-01-22 18:30:11 +01:00
server_id_db_util.h
…
server_id_watch.c
lib: Avoid an unnecessary include
2020-01-14 19:17:28 +00:00
server_id_watch.h
lib: Remove "msg_ctx" from server_id_watch_send()
2020-01-14 19:17:28 +00:00
server_mutex.c
lib: Pass mem_ctx to lock_path()
2018-08-17 11:30:10 +02:00
serverid.c
lib/messaging: Move messages_dgm out of source3
2020-05-06 00:06:40 +00:00
sessionid_tdb.c
s3:smbstatus: pretty print the use of new signing/encryption algorithms
2021-07-15 00:06:31 +00:00
sharesec.c
lib: Make get_share_security_default static
2020-09-12 06:29:37 +00:00
smbd_shim.c
smbd: Remove source3/smbd/statcache.c
2022-12-14 22:54:29 +00:00
smbd_shim.h
smbd: Remove source3/smbd/statcache.c
2022-12-14 22:54:29 +00:00
smbldap.c
s3:lib: Fix trailing whitespaces in smbldap.c
2022-08-26 07:59:32 +00:00
smbrun.c
lib: Use closefrom() in smbrun.c
2020-01-19 18:29:39 +00:00
srprs.c
s3: net: Harden srprs_str() against memcmp overread.
2019-05-15 21:26:12 +00:00
srprs.h
lib: Fix prototype of srprs_str
2018-07-24 20:36:50 +02:00
string_replace.c
lib: Replace a call to TALLOC_ZERO()
2021-04-19 18:18:31 +00:00
string_replace.h
s3: move fruit catia string replace mappings to s3/lib/
2019-07-12 21:31:29 +00:00
substitute_generic.c
lib: Remove fstring_sub() that was used just once
2022-12-12 21:16:33 +00:00
substitute.c
lib: Fix whitespace
2022-12-14 04:32:34 +00:00
substitute.h
lib: Add get_current_user_info_domain()
2022-12-12 21:16:33 +00:00
sysacls.c
vfs_aixacl: add proper header file
2022-02-18 22:17:33 +00:00
sysquotas_4A.c
…
sysquotas_4B.c
sysquotas_4B: raise log level of a sometimes too noisy message
2019-02-17 13:33:14 +01:00
sysquotas_jfs2.c
add sysquotas_jfs2.c
2019-02-17 13:33:13 +01:00
sysquotas_linux.c
sysquotas_linux: fix inode limit setting, which is not depeding on blocksize
2019-02-17 13:33:12 +01:00
sysquotas_nfs.c
sysquotas_nfs: also honor reported inode/file limits
2019-02-17 13:33:13 +01:00
sysquotas_xfs.c
sysquotas_xfs: fix inode limit setting, which is not depeding on blocksize
2019-02-17 13:33:12 +01:00
sysquotas.c
lib: Save a few lines with str_list_add_printf()
2022-01-18 20:22:38 +00:00
system_smbd.c
Don't use sysconf(_SC_NGROUPS_MAX) on macOS for getgroups()
2021-09-09 17:43:19 +00:00
system.c
smbd: remove itime and file_id logic and code
2022-03-31 23:01:37 +00:00
tallocmsg.c
lib: Remove unneded #include malloc.h
2020-02-19 09:38:39 +00:00
tdb_validate.c
…
tdb_validate.h
…
test_adouble.c
CVE-2021-44142: libadouble: add basic cmocka tests
2022-01-31 15:27:37 +00:00
test_tldap.c
Fix uClibc build on 64bit platforms by including stdint.h
2019-05-19 17:34:20 +00:00
tevent_barrier.c
lib: Avoid a "includes.h"
2017-01-22 18:30:11 +01:00
tevent_barrier.h
…
tevent_glib_glue_tests.c
s3/lib: add a tevent_glib_glue subsystem test
2019-04-24 18:32:14 +00:00
tevent_glib_glue.c
s3:lib: Fix possible 32-bit arithmetic overflow
2022-03-05 08:04:28 +00:00
tevent_glib_glue.h
s3/lib: new tevent_glib_glue subsystem
2019-04-24 18:32:14 +00:00
time.c
s3:lib: use nt_time_to_full_timespec() in interpret_long_date()
2019-12-06 00:17:36 +00:00
tldap_gensec_bind.c
…
tldap_gensec_bind.h
…
tldap_util.c
lib: relicense smb_strtoul(l) under LGPLv3
2020-08-03 22:21:02 +00:00
tldap.c
lib: Align integer types
2020-12-04 21:08:38 +00:00
username.c
s3: safe_string: do not include string_wrappers.h
2020-08-28 00:56:34 +00:00
util_builtin.c
…
util_cluster.c
lib: Avoid an #include includes.h
2022-10-27 18:18:36 +00:00
util_cluster.h
…
util_ea.c
…
util_ea.h
…
util_event.c
lib: #include "util_event.h" only where needed
2018-04-24 22:26:22 +02:00
util_file.c
lib: Fix file_ploadv_send/recv cleanup
2021-03-09 22:36:28 +00:00
util_file.h
s3: lib: Rename all uses of file_pload_XXX -> file_ploadv_XXX.
2019-05-24 19:00:06 +00:00
util_macstreams.c
s3:lib: move Mac streams util functions to s3/lib
2019-07-12 21:31:29 +00:00
util_macstreams.h
s3:lib: move Mac streams util functions to s3/lib
2019-07-12 21:31:29 +00:00
util_malloc.c
lib: Fix a typo
2022-08-26 18:54:37 +00:00
util_matching.c
s3:lib: add samba_path_matching_regex_sub1_create()
2021-07-01 13:02:31 +00:00
util_matching.h
s3:lib: add samba_path_matching_regex_sub1_create()
2021-07-01 13:02:31 +00:00
util_names.c
CVE-2020-25717: s3:lib: add lp_allow_trusted_domains() logic to is_allowed_domain()
2021-11-09 19:45:33 +00:00
util_nscd.c
…
util_nttoken.c
lib: Align integer types
2021-01-22 19:54:38 +00:00
util_path.c
libsmb: Simplify clistr_is_previous_version_path()
2022-12-16 08:42:18 +00:00
util_path.h
libsmb: Simplify clistr_is_previous_version_path()
2022-12-16 08:42:18 +00:00
util_procid.c
lib/messaging: Move messages_dgm out of source3
2020-05-06 00:06:40 +00:00
util_procid.h
…
util_sd.c
lib: Fix out-of-bounds access in print_ace_flags()
2023-01-12 15:38:30 +00:00
util_sec.c
lib: Improve comment wording
2021-08-24 17:32:28 +00:00
util_sid_passdb.c
lib: Add lib/util_unixsids.h
2016-12-28 20:17:12 +01:00
util_sid_passdb.h
…
util_sid.c
lib: Give util_specialsids.c its own prototype header
2021-09-21 00:13:32 +00:00
util_sock.c
lib: Add lp_allow_local_address()
2022-11-10 07:27:31 +00:00
util_specialsids.c
lib: Avoid an "includes.h"
2021-09-21 00:13:32 +00:00
util_specialsids.h
lib: Give util_specialsids.c its own prototype header
2021-09-21 00:13:32 +00:00
util_str.c
lib: Remove unused octal_string()
2022-12-12 21:16:33 +00:00
util_tdb.c
lib: Add tdb_data_dbg()
2023-01-10 00:28:37 +00:00
util_transfer_file.c
…
util_tsock.c
…
util_tsock.h
…
util_unixsids.c
lib: Avoid an includes.h
2016-12-28 20:17:13 +01:00
util_unixsids.h
passdb: Move lookup_unix_[user|group]_name to lookup_sid.c
2016-12-28 20:17:12 +01:00
util_wellknown.c
lib: Use dom_sid_str_buf
2018-12-20 23:40:25 +01:00
util.c
lib: Move tab_depth() to reg_parse_prs.c
2023-01-10 00:28:37 +00:00
version_test.c
…
version.c
…
winbind_util.c
lib/winbind_util: Add winbind_xid_to_sid for --without-winbind
2019-03-06 01:53:16 +00:00
winbind_util.h
lib: Remove some unused code
2019-02-28 13:53:40 +00:00
wins_srv.c
s3: libsmb: Convert the WINS and broadcast name functions to return size_t * num addresses.
2020-09-15 10:09:36 +00:00
xattr_tdb.c
vfs: Use file_id_str_buf() in xattr_tdb_setattr()
2019-09-10 23:14:31 +00:00
xattr_tdb.h
…