1
0
mirror of https://github.com/samba-team/samba.git synced 2025-02-03 13:47:25 +03:00
Stefan Metzmacher 9d797ffb27 tevent: fix access after free in tevent_common_check_signal()
This was reported by Pavel Březina <pbrezina@redhat.com>:

    We found a crash in SSSD when a tevent signal is freed in its handler, tevent
    than crashes when it access siginfo.

    sig_info is freed in signal destructor:

    > #ifdef SA_SIGINFO
    >         if (se->sa_flags & SA_SIGINFO) {
    >             if (sig_state->sig_info[se->signum]) {
    >                 talloc_free(sig_state->sig_info[se->signum]);
    >                 sig_state->sig_info[se->signum] = NULL;
    >             }
    >         }
    > #endif

    (gdb) bt
    #0  0x00007f5d4d86cc74 in tevent_signal_destructor (se=0x7f5d5370f920) at
    ../tevent_signal.c:213
    #1  0x00007f5d4d65f233 in _talloc_free_internal () from /lib64/libtalloc.so.2
    #2  0x00007f5d4d6593a3 in _talloc_free () from /lib64/libtalloc.so.2
    #3  0x00007f5d4342f3d4 in proxy_child_init_done (subreq=0x7f5d5370f600) at
    src/providers/proxy/proxy_auth.c:436
    #4  0x00007f5d4d86b0c2 in _tevent_req_error (req=req@entry=0x7f5d5370f600,
    error=error@entry=5, location=location@entry=0x7f5d43433010
    "src/providers/proxy/proxy_auth.c:356")
        at ../tevent_req.c:167
    #5  0x00007f5d4342ef5e in pc_init_sig_handler (ev=<optimized out>,
    sige=<optimized out>, signum=<optimized out>, count=<optimized out>,
    __siginfo=<optimized out>, pvt=<optimized out>)
        at src/providers/proxy/proxy_auth.c:356
    #6  0x00007f5d4d86d48c in tevent_common_check_signal (ev=0x7f5d536de670) at
    ../tevent_signal.c:428
    #7  0x00007f5d4d86f28c in epoll_event_loop (tvalp=0x7fff7b568490,
    epoll_ev=0x7f5d536de8b0) at ../tevent_epoll.c:647
    #8  epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at
    ../tevent_epoll.c:926
    #9  0x00007f5d4d86d7d7 in std_event_loop_once (ev=0x7f5d536de670,
    location=0x7f5d50faedc3 "src/util/server.c:668") at ../tevent_standard.c:114
    #10 0x00007f5d4d869fbd in _tevent_loop_once (ev=ev@entry=0x7f5d536de670,
    location=location@entry=0x7f5d50faedc3 "src/util/server.c:668") at
    ../tevent.c:530
    #11 0x00007f5d4d86a15b in tevent_common_loop_wait (ev=0x7f5d536de670,
    location=0x7f5d50faedc3 "src/util/server.c:668") at ../tevent.c:634
    #12 0x00007f5d4d86d777 in std_event_loop_wait (ev=0x7f5d536de670,
    location=0x7f5d50faedc3 "src/util/server.c:668") at ../tevent_standard.c:140
    #13 0x00007f5d50f96863 in server_loop (main_ctx=0x7f5d536dfac0) at
    src/util/server.c:668
    #14 0x00007f5d5180aa42 in main (argc=8, argv=<optimized out>) at
    src/providers/data_provider_be.c:2909

    But then it is accessed again in tevent_common_check_signal:

    > #ifdef SA_SIGINFO
    >         if (clear_processed_siginfo) {
    >             uint32_t j;
    >             for (j=0;j<count;j++) {
    >                 uint32_t ofs = (counter.seen + j)
    >                     % TEVENT_SA_INFO_QUEUE_COUNT;
    >                 memset((void*)&sig_state->sig_info[i][ofs],
    >                     '\0',
    >                     sizeof(siginfo_t));
    >             }
    >         }
    > #endif

    (gdb) bt
    #0  0x00007fd7ba400505 in memset (__len=<optimized out>, __ch=<optimized out>,
    __dest=<optimized out>) at /usr/include/bits/string3.h:84
    #1  tevent_common_check_signal (ev=0x7fd7bfddf670) at ../tevent_signal.c:459
    #2  0x00007fd7ba40228c in epoll_event_loop (tvalp=0x7fff85536430,
    epoll_ev=0x7fd7bfddf8b0) at ../tevent_epoll.c:647
    #3  epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at
    ../tevent_epoll.c:926
    #4  0x00007fd7ba4007d7 in std_event_loop_once (ev=0x7fd7bfddf670,
    location=0x7fd7bdb417c3 "src/util/server.c:668") at ../tevent_standard.c:114
    #5  0x00007fd7ba3fcfbd in _tevent_loop_once (ev=ev@entry=0x7fd7bfddf670,
    location=location@entry=0x7fd7bdb417c3 "src/util/server.c:668") at
    ../tevent.c:530
    #6  0x00007fd7ba3fd15b in tevent_common_loop_wait (ev=0x7fd7bfddf670,
    location=0x7fd7bdb417c3 "src/util/server.c:668") at ../tevent.c:634
    #7  0x00007fd7ba400777 in std_event_loop_wait (ev=0x7fd7bfddf670,
    location=0x7fd7bdb417c3 "src/util/server.c:668") at ../tevent_standard.c:140
    #8  0x00007fd7bdb29343 in server_loop (main_ctx=0x7fd7bfde0ac0) at
    src/util/server.c:668
    #9  0x00007fd7be39ca42 in main (argc=8, argv=<optimized out>) at
    src/providers/data_provider_be.c:2909

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11308

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Jun  2 21:02:11 CEST 2015 on sn-devel-104
2015-06-02 21:02:11 +02:00
2015-03-17 11:30:51 +01:00
2010-12-18 00:47:06 +01:00
2015-04-15 05:58:19 +02:00
2014-11-19 18:30:06 +01:00
2013-02-18 22:07:39 +11:00
2015-05-22 01:44:19 +02:00
2014-10-01 10:56:19 +02:00
2015-03-23 23:59:36 +01:00
2015-03-24 00:00:20 +01:00

This is the release version of Samba, the free SMB and CIFS client and
server and Domain Controller for UNIX and other operating
systems. Samba is maintained by the Samba Team, who support the
original author, Andrew Tridgell.

>>>> Please read THE WHOLE of this file as it gives important information
>>>> about the configuration and use of Samba.

NOTE: Installation instructions may be found
      for the file/print server and domain member in:
      docs/htmldocs/Samba3-HOWTO/install.html

      For the AD DC implementation a full HOWTO is provided at:
      http://wiki.samba.org/index.php/Samba4/HOWTO

This software is freely distributable under the GNU public license, a
copy of which you should have received with this software (in a file
called COPYING). 


WHAT IS SMB/CIFS?
=================

This is a big question. 

The very short answer is that it is the protocol by which a lot of
PC-related machines share files and printers and other information
such as lists of available files and printers. Operating systems that
support this natively include Windows 9x, Windows NT (and derivatives), 
OS/2, Mac OS X and Linux.  Add on packages that achieve the same 
thing are available for DOS, Windows 3.1, VMS, Unix of all kinds, 
MVS, and more.  Some Web Browsers can speak this protocol as well 
(smb://).  Alternatives to SMB include Netware, NFS, Appletalk, 
Banyan Vines, Decnet etc; many of these have advantages but none are 
both public specifications and widely implemented in desktop machines 
by default.

The Common Internet File system (CIFS) is what the new SMB initiative
is called. For details watch http://samba.org/cifs.


WHY DO PEOPLE WANT TO USE SMB?
==============================

1. Many people want to integrate their Microsoft desktop clients
   with their Unix servers.

2. Others want to integrate their Microsoft (etc) servers with Unix
   servers. This is a different problem to integrating desktop 
   clients.

3. Others want to replace protocols like NFS, DecNet and Novell NCP,
   especially when used with PCs.


WHAT CAN SAMBA DO?
==================

Please refer to the WHATSNEW.txt included with this README for
a list of features in the latest Samba release.

Here is a very short list of what samba includes, and what it does. 
For many networks this can be simply summarized by "Samba provides 
a complete replacement for Windows NT, Warp, NFS or Netware servers."

- a SMB server, to provide Windows NT and LAN Manager-style file and print 
  services to SMB clients such as Windows 95, Warp Server, smbfs and others.

- a Windows Domain Controller (NT4 and AD) replacement.

- a file/print server that can act as a member of a Windows NT 4.0
  or Active Directory domain.

- a NetBIOS (rfc1001/1002) nameserver, which amongst other things gives 
  browsing support. Samba can be the master browser on your LAN if you wish.

- a ftp-like SMB client so you can access PC resources (disks and
  printers) from UNIX, Netware, and other operating systems

- a tar extension to the client for backing up PCs

- limited command-line tool that supports some of the NT administrative
  functionality, which can be used on Samba, NT workstation and NT server.

For a much better overview have a look at the web site at
http://samba.org/samba, and browse the user survey.

Related packages include:

- cifsvfs, an advanced Linux-only filesystem allowing you to mount 
  remote SMB filesystems from PCs on your Linux box. This is included 
  as standard with Linux 2.5 and later.

- smbfs, the previous Linux-only filesystem allowing you to mount remote SMB
  filesystems from PCs on your Linux box. This is included as standard with
  Linux 2.0 and later.



CONTRIBUTIONS
=============

If you want to contribute to the development of the software then
please join the mailing list. The Samba team accepts patches
(preferably in "diff -u" format, see http://samba.org/samba/devel/ 
for more details) and are always glad to receive feedback or 
suggestions to the address samba@lists.samba.org.  More information
on the various Samba mailing lists can be found at http://lists.samba.org/.

You can also get the Samba sourcecode straight from the git repository - see
http://wiki.samba.org/index.php/Using_Git_for_Samba_Development.

If you like a particular feature then look through the git change-log
(on the web at http://gitweb.samba.org/?p=samba.git;a=summary) and see
who added it, then send them an email.

Remember that free software of this kind lives or dies by the response
we get. If no one tells us they like it then we'll probably move onto
something else.

MORE INFO
=========

DOCUMENTATION
-------------

There is quite a bit of documentation included with the package,
including man pages, and lots of .html files with hints and useful
info. This is also available from the web page. There is a growing
collection of information under docs/.

A list of Samba documentation in languages other than English is
available on the web page.

If you would like to help with the documentation, please coodinate 
on the samba@samba.org mailing list.  See the next section for details 
on subscribing to samba mailing lists.


MAILING LIST
------------

Please do NOT send subscription/unsubscription requests to the lists!

There is a mailing list for discussion of Samba.  For details go to
<http://lists.samba.org/> or send mail to <samba-subscribe@lists.samba.org>

There is also an announcement mailing list where new versions are
announced.  To subscribe go to <http://lists.samba.org/> or send mail
to <samba-announce-subscribe@lists.samba.org>.  All announcements also
go to the samba list, so you only need to be on one.

For details of other Samba mailing lists and for access to archives, see
<http://lists.samba.org/>


MAILING LIST ETIQUETTE
----------------------

A few tips when submitting to this or any mailing list.

1. Make your subject short and descriptive. Avoid the words "help" or
   "Samba" in the subject. The readers of this list already know that
   a) you need help, and b) you are writing about samba (of course,
   you may need to distinguish between Samba PDC and other file
   sharing software). Avoid phrases such as "what is" and "how do
   i". Some good subject lines might look like "Slow response with
   Excel files" or "Migrating from Samba PDC to NT PDC".

2. If you include the original message in your reply, trim it so that
   only the relevant lines, enough to establish context, are
   included. Chances are (since this is a mailing list) we've already
   read the original message.

3. Trim irrelevant headers from the original message in your
   reply. All we need to see is a) From, b) Date, and c) Subject. We
   don't even really need the Subject, if you haven't changed
   it. Better yet is to just preface the original message with "On
   [date] [someone] wrote:".

4. Please don't reply to or argue about spam, spam filters or viruses
   on any Samba lists. We do have a spam filtering system that is
   working quite well thank you very much but occasionally unwanted
   messages slip through. Deal with it.

5. Never say "Me too." It doesn't help anyone solve the
   problem. Instead, if you ARE having the same problem, give more
   information. Have you seen something that the other writer hasn't
   mentioned, which may be helpful?

6. If you ask about a problem, then come up with the solution on your
   own or through another source, by all means post it. Someone else
   may have the same problem and is waiting for an answer, but never
   hears of it.

7. Give as much *relevant* information as possible such as Samba
   release number, OS, kernel version, etc...

8. RTFM. Google. groups.google.com.


WEB SITE
--------

A Samba WWW site has been setup with lots of useful info. Connect to:

http://samba.org/

As well as general information and documentation, this also has searchable 
archives of the mailing list and a user survey that shows who else is using
this package.

Description
https://gitlab.com/samba-team/samba is the Official GitLab mirror of https://git.samba.org/samba.git -- Merge requests should be made on GitLab (not on GitHub)
Readme 452 MiB
Languages
C 76.4%
Python 18.8%
Shell 2.8%
Perl 1.4%
Rust 0.3%
Other 0.1%