mirror of
https://github.com/samba-team/samba.git
synced 2025-02-03 13:47:25 +03:00
Stefan Metzmacher
9d797ffb27
tevent: fix access after free in tevent_common_check_signal()
This was reported by Pavel Březina <pbrezina@redhat.com>: We found a crash in SSSD when a tevent signal is freed in its handler, tevent than crashes when it access siginfo. sig_info is freed in signal destructor: > #ifdef SA_SIGINFO > if (se->sa_flags & SA_SIGINFO) { > if (sig_state->sig_info[se->signum]) { > talloc_free(sig_state->sig_info[se->signum]); > sig_state->sig_info[se->signum] = NULL; > } > } > #endif (gdb) bt #0 0x00007f5d4d86cc74 in tevent_signal_destructor (se=0x7f5d5370f920) at ../tevent_signal.c:213 #1 0x00007f5d4d65f233 in _talloc_free_internal () from /lib64/libtalloc.so.2 #2 0x00007f5d4d6593a3 in _talloc_free () from /lib64/libtalloc.so.2 #3 0x00007f5d4342f3d4 in proxy_child_init_done (subreq=0x7f5d5370f600) at src/providers/proxy/proxy_auth.c:436 #4 0x00007f5d4d86b0c2 in _tevent_req_error (req=req@entry=0x7f5d5370f600, error=error@entry=5, location=location@entry=0x7f5d43433010 "src/providers/proxy/proxy_auth.c:356") at ../tevent_req.c:167 #5 0x00007f5d4342ef5e in pc_init_sig_handler (ev=<optimized out>, sige=<optimized out>, signum=<optimized out>, count=<optimized out>, __siginfo=<optimized out>, pvt=<optimized out>) at src/providers/proxy/proxy_auth.c:356 #6 0x00007f5d4d86d48c in tevent_common_check_signal (ev=0x7f5d536de670) at ../tevent_signal.c:428 #7 0x00007f5d4d86f28c in epoll_event_loop (tvalp=0x7fff7b568490, epoll_ev=0x7f5d536de8b0) at ../tevent_epoll.c:647 #8 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../tevent_epoll.c:926 #9 0x00007f5d4d86d7d7 in std_event_loop_once (ev=0x7f5d536de670, location=0x7f5d50faedc3 "src/util/server.c:668") at ../tevent_standard.c:114 #10 0x00007f5d4d869fbd in _tevent_loop_once (ev=ev@entry=0x7f5d536de670, location=location@entry=0x7f5d50faedc3 "src/util/server.c:668") at ../tevent.c:530 #11 0x00007f5d4d86a15b in tevent_common_loop_wait (ev=0x7f5d536de670, location=0x7f5d50faedc3 "src/util/server.c:668") at ../tevent.c:634 #12 0x00007f5d4d86d777 in std_event_loop_wait (ev=0x7f5d536de670, location=0x7f5d50faedc3 "src/util/server.c:668") at ../tevent_standard.c:140 #13 0x00007f5d50f96863 in server_loop (main_ctx=0x7f5d536dfac0) at src/util/server.c:668 #14 0x00007f5d5180aa42 in main (argc=8, argv=<optimized out>) at src/providers/data_provider_be.c:2909 But then it is accessed again in tevent_common_check_signal: > #ifdef SA_SIGINFO > if (clear_processed_siginfo) { > uint32_t j; > for (j=0;j<count;j++) { > uint32_t ofs = (counter.seen + j) > % TEVENT_SA_INFO_QUEUE_COUNT; > memset((void*)&sig_state->sig_info[i][ofs], > '\0', > sizeof(siginfo_t)); > } > } > #endif (gdb) bt #0 0x00007fd7ba400505 in memset (__len=<optimized out>, __ch=<optimized out>, __dest=<optimized out>) at /usr/include/bits/string3.h:84 #1 tevent_common_check_signal (ev=0x7fd7bfddf670) at ../tevent_signal.c:459 #2 0x00007fd7ba40228c in epoll_event_loop (tvalp=0x7fff85536430, epoll_ev=0x7fd7bfddf8b0) at ../tevent_epoll.c:647 #3 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../tevent_epoll.c:926 #4 0x00007fd7ba4007d7 in std_event_loop_once (ev=0x7fd7bfddf670, location=0x7fd7bdb417c3 "src/util/server.c:668") at ../tevent_standard.c:114 #5 0x00007fd7ba3fcfbd in _tevent_loop_once (ev=ev@entry=0x7fd7bfddf670, location=location@entry=0x7fd7bdb417c3 "src/util/server.c:668") at ../tevent.c:530 #6 0x00007fd7ba3fd15b in tevent_common_loop_wait (ev=0x7fd7bfddf670, location=0x7fd7bdb417c3 "src/util/server.c:668") at ../tevent.c:634 #7 0x00007fd7ba400777 in std_event_loop_wait (ev=0x7fd7bfddf670, location=0x7fd7bdb417c3 "src/util/server.c:668") at ../tevent_standard.c:140 #8 0x00007fd7bdb29343 in server_loop (main_ctx=0x7fd7bfde0ac0) at src/util/server.c:668 #9 0x00007fd7be39ca42 in main (argc=8, argv=<optimized out>) at src/providers/data_provider_be.c:2909 BUG: https://bugzilla.samba.org/show_bug.cgi?id=11308 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Jun 2 21:02:11 CEST 2015 on sn-devel-104
…
…
This is the release version of Samba, the free SMB and CIFS client and server and Domain Controller for UNIX and other operating systems. Samba is maintained by the Samba Team, who support the original author, Andrew Tridgell. >>>> Please read THE WHOLE of this file as it gives important information >>>> about the configuration and use of Samba. NOTE: Installation instructions may be found for the file/print server and domain member in: docs/htmldocs/Samba3-HOWTO/install.html For the AD DC implementation a full HOWTO is provided at: http://wiki.samba.org/index.php/Samba4/HOWTO This software is freely distributable under the GNU public license, a copy of which you should have received with this software (in a file called COPYING). WHAT IS SMB/CIFS? ================= This is a big question. The very short answer is that it is the protocol by which a lot of PC-related machines share files and printers and other information such as lists of available files and printers. Operating systems that support this natively include Windows 9x, Windows NT (and derivatives), OS/2, Mac OS X and Linux. Add on packages that achieve the same thing are available for DOS, Windows 3.1, VMS, Unix of all kinds, MVS, and more. Some Web Browsers can speak this protocol as well (smb://). Alternatives to SMB include Netware, NFS, Appletalk, Banyan Vines, Decnet etc; many of these have advantages but none are both public specifications and widely implemented in desktop machines by default. The Common Internet File system (CIFS) is what the new SMB initiative is called. For details watch http://samba.org/cifs. WHY DO PEOPLE WANT TO USE SMB? ============================== 1. Many people want to integrate their Microsoft desktop clients with their Unix servers. 2. Others want to integrate their Microsoft (etc) servers with Unix servers. This is a different problem to integrating desktop clients. 3. Others want to replace protocols like NFS, DecNet and Novell NCP, especially when used with PCs. WHAT CAN SAMBA DO? ================== Please refer to the WHATSNEW.txt included with this README for a list of features in the latest Samba release. Here is a very short list of what samba includes, and what it does. For many networks this can be simply summarized by "Samba provides a complete replacement for Windows NT, Warp, NFS or Netware servers." - a SMB server, to provide Windows NT and LAN Manager-style file and print services to SMB clients such as Windows 95, Warp Server, smbfs and others. - a Windows Domain Controller (NT4 and AD) replacement. - a file/print server that can act as a member of a Windows NT 4.0 or Active Directory domain. - a NetBIOS (rfc1001/1002) nameserver, which amongst other things gives browsing support. Samba can be the master browser on your LAN if you wish. - a ftp-like SMB client so you can access PC resources (disks and printers) from UNIX, Netware, and other operating systems - a tar extension to the client for backing up PCs - limited command-line tool that supports some of the NT administrative functionality, which can be used on Samba, NT workstation and NT server. For a much better overview have a look at the web site at http://samba.org/samba, and browse the user survey. Related packages include: - cifsvfs, an advanced Linux-only filesystem allowing you to mount remote SMB filesystems from PCs on your Linux box. This is included as standard with Linux 2.5 and later. - smbfs, the previous Linux-only filesystem allowing you to mount remote SMB filesystems from PCs on your Linux box. This is included as standard with Linux 2.0 and later. CONTRIBUTIONS ============= If you want to contribute to the development of the software then please join the mailing list. The Samba team accepts patches (preferably in "diff -u" format, see http://samba.org/samba/devel/ for more details) and are always glad to receive feedback or suggestions to the address samba@lists.samba.org. More information on the various Samba mailing lists can be found at http://lists.samba.org/. You can also get the Samba sourcecode straight from the git repository - see http://wiki.samba.org/index.php/Using_Git_for_Samba_Development. If you like a particular feature then look through the git change-log (on the web at http://gitweb.samba.org/?p=samba.git;a=summary) and see who added it, then send them an email. Remember that free software of this kind lives or dies by the response we get. If no one tells us they like it then we'll probably move onto something else. MORE INFO ========= DOCUMENTATION ------------- There is quite a bit of documentation included with the package, including man pages, and lots of .html files with hints and useful info. This is also available from the web page. There is a growing collection of information under docs/. A list of Samba documentation in languages other than English is available on the web page. If you would like to help with the documentation, please coodinate on the samba@samba.org mailing list. See the next section for details on subscribing to samba mailing lists. MAILING LIST ------------ Please do NOT send subscription/unsubscription requests to the lists! There is a mailing list for discussion of Samba. For details go to <http://lists.samba.org/> or send mail to <samba-subscribe@lists.samba.org> There is also an announcement mailing list where new versions are announced. To subscribe go to <http://lists.samba.org/> or send mail to <samba-announce-subscribe@lists.samba.org>. All announcements also go to the samba list, so you only need to be on one. For details of other Samba mailing lists and for access to archives, see <http://lists.samba.org/> MAILING LIST ETIQUETTE ---------------------- A few tips when submitting to this or any mailing list. 1. Make your subject short and descriptive. Avoid the words "help" or "Samba" in the subject. The readers of this list already know that a) you need help, and b) you are writing about samba (of course, you may need to distinguish between Samba PDC and other file sharing software). Avoid phrases such as "what is" and "how do i". Some good subject lines might look like "Slow response with Excel files" or "Migrating from Samba PDC to NT PDC". 2. If you include the original message in your reply, trim it so that only the relevant lines, enough to establish context, are included. Chances are (since this is a mailing list) we've already read the original message. 3. Trim irrelevant headers from the original message in your reply. All we need to see is a) From, b) Date, and c) Subject. We don't even really need the Subject, if you haven't changed it. Better yet is to just preface the original message with "On [date] [someone] wrote:". 4. Please don't reply to or argue about spam, spam filters or viruses on any Samba lists. We do have a spam filtering system that is working quite well thank you very much but occasionally unwanted messages slip through. Deal with it. 5. Never say "Me too." It doesn't help anyone solve the problem. Instead, if you ARE having the same problem, give more information. Have you seen something that the other writer hasn't mentioned, which may be helpful? 6. If you ask about a problem, then come up with the solution on your own or through another source, by all means post it. Someone else may have the same problem and is waiting for an answer, but never hears of it. 7. Give as much *relevant* information as possible such as Samba release number, OS, kernel version, etc... 8. RTFM. Google. groups.google.com. WEB SITE -------- A Samba WWW site has been setup with lots of useful info. Connect to: http://samba.org/ As well as general information and documentation, this also has searchable archives of the mailing list and a user survey that shows who else is using this package.
Description
https://gitlab.com/samba-team/samba is the Official GitLab mirror of https://git.samba.org/samba.git -- Merge requests should be made on GitLab (not on GitHub)
Readme
452 MiB
Languages
C
76.4%
Python
18.8%
Shell
2.8%
Perl
1.4%
Rust
0.3%
Other
0.1%