Bug 113558

Summary: kdc segfaults on startup while sorting interfaces
Product: [Fedora] Fedora Reporter: Paul Jakma <paul+rhbugz>
Component: krb5Assignee: Nalin Dahyabhai <nalin>
Status: CLOSED DUPLICATE QA Contact: Brian Brock <bbrock>
Severity: high Docs Contact:
Priority: high    
Version: 1   
Target Milestone: ---   
Target Release: ---   
Hardware: i586   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-02-21 19:00:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Paul Jakma 2004-01-15 10:42:03 UTC
Description of problem:

The kdc binary segfaults on start up while sorting through the
interfaces on the system in
src/include/foreachaddr.c::foreach_localaddr(). It appears that the
ifp list can sometimes contain interfaces with NULL ->ifa_addrs.
However this function does not take this into account and calls
functions which dereference ifa_addrs.

See also bug i opened with upstream: [krbdev.mit.edu #2115].

Version-Release number of selected component (if applicable):

krb5-server 1.3.1-6

How reproducible:

very.

Steps to Reproduce:
1. setup interfaces to be similar to:

$ ip a
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
    inet6 ff02::1/128 scope global 
       valid_lft forever preferred_lft forever
2: usb0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether e6:91:5b:86:21:0f brd ff:ff:ff:ff:ff:ff
    inet6 2001:770:105:2:20df:4eff:fe29:c2a9/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::e491:5bff:fe86:210f/64 scope link 
       valid_lft forever preferred_lft forever
    inet6 ff02::9/128 scope global 
       valid_lft forever preferred_lft forever
    inet6 ff02::2/128 scope global 
       valid_lft forever preferred_lft forever
    inet6 ff02::1:ff29:c2a9/128 scope global 
       valid_lft forever preferred_lft forever
    inet6 ff02::1:ff86:210f/128 scope global 
       valid_lft forever preferred_lft forever
    inet6 ff02::1/128 scope global 
       valid_lft forever preferred_lft forever
3: sit0: <NOARP> mtu 1480 qdisc noop 
    link/sit 0.0.0.0 brd 0.0.0.0
4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:00:f8:10:88:00 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.4/24 brd 192.168.0.255 scope global eth0
    inet6 2001:770:105:1:200:f8ff:fe10:8800/64 scope global dynamic 
       valid_lft 1795sec preferred_lft 595sec
    inet6 fe80::200:f8ff:fe10:8800/64 scope link 
       valid_lft forever preferred_lft forever
    inet6 ff02::9/128 scope global 
       valid_lft forever preferred_lft forever
    inet6 ff02::2/128 scope global 
       valid_lft forever preferred_lft forever
    inet6 ff02::1:ff10:8800/128 scope global 
       valid_lft forever preferred_lft forever
    inet6 ff02::1/128 scope global 
       valid_lft forever preferred_lft forever

2. run kdc
3. watch it segfault
  
Actual results:

SEGV in several places, all due to foreach_localaddr passing on NULL
ifa_addr's. kdc fails to start, local network is left without
authentication services.

Expected results:

kdc starts, doesnt crash and provides normal service.

Additional info:

See [krbdev.mit.edu #2115] for back traces.

Comment 1 Nalin Dahyabhai 2004-01-19 19:17:48 UTC

*** This bug has been marked as a duplicate of 113347 ***

Comment 2 Nalin Dahyabhai 2004-01-19 19:19:40 UTC
Upstream report:
http://mailman.mit.edu/pipermail/krb5-bugs/2004-January/002152.html

Comment 3 Red Hat Bugzilla 2006-02-21 19:00:46 UTC
Changed to 'CLOSED' state since 'RESOLVED' has been deprecated.