Bug 1622168

Summary: ipa-otpd: fix potential double-free and infinite loop in queue code
Product: Red Hat Enterprise Linux 7 Reporter: Robbie Harwood <rharwood>
Component: ipaAssignee: IPA Maintainers <ipa-maint>
Status: CLOSED ERRATA QA Contact: ipa-qe <ipa-qe>
Severity: high Docs Contact:
Priority: high    
Version: 7.6CC: abokovoy, extras-qa, frenaud, ipa-maint, ipa-qe, jcholast, jhrozek, ndehadra, pvoborni, rcritten, spoore, ssorce, tdudlak, tscherf
Target Milestone: rcKeywords: ZStream
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
URL: https://github.com/freeipa/freeipa/pull/2283
Whiteboard:
Fixed In Version: ipa-4.6.4-8.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1622166
: 1624811 (view as bug list) Environment:
Last Closed: 2018-10-30 11:00:22 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1622165    
Bug Blocks: 1508498, 1624811    

Description Robbie Harwood 2018-08-24 15:00:42 UTC
+++ This bug was initially created as a clone of Bug #1622165 +++

Upstream PR: https://github.com/freeipa/freeipa/pull/2283

The ipa-otpd code occasionally removes elements from one queue,
inspects and modifies them, and then inserts them into
another (possibly identical, possibly different) queue. When the next
pointer isn't cleared, this can result in element membership in both
queues, leading to double frees, or even self-referential elements,
causing infinite loops at traversal time.

Rather than eliminating the pattern, make it safe by clearing the next
field any time an element enters or exits a queue.

This is the crash spoore reported in 1508498.

Comment 7 Tibor Dudlák 2018-09-04 12:39:42 UTC
BZ marked as MODIFIED by mistake changing back to POST.

Comment 15 Scott Poore 2018-09-12 13:47:51 UTC
Verified.

Version ::

ipa-server-4.6.4-9.el7.x86_64


Results ::

STR job run on simple IPA Master-Replica-Client environment.

Run ID 	R-4849
Profile Name 	idm-76-otp-pos1
Run Name 	idm_bug_check_totp_7_lce-1
Tester 	spoore
State 	Complete Complete
Group 	idm
Start Date 	2018-09-11 18:12:13
Stop Date 	2018-09-12 06:12:13
Test Duration 	Days:0, Hrs:12, Mins:0, Secs:0
Lab Controller Engine 	LCE-1-10.8.48.121:8084

I did not see any crash reports during this run.  We were seeing crashes very frequently when we ran this test.

[root@qe-blade-04 log]# abrt-cli list
The Autoreporting feature is disabled. Please consider enabling it by issuing
'abrt-auto-reporting enabled' as a user with root privileges


[root@qe-blade-09 slapd-QE-STI-COM]# abrt-cli list
The Autoreporting feature is disabled. Please consider enabling it by issuing
'abrt-auto-reporting enabled' as a user with root privileges

Also, I adjusted the tests slightly to no longer throw failures when prompted for ldap password if the password was rejected.  As long as the prompt does not then allow login, I left it marked passed to simplify troubleshooting for this bug.  All cases of this that I investigated when this occurred were due to locked accounts which could be the result of the negative tests running too frequently.

Comment 17 errata-xmlrpc 2018-10-30 11:00:22 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3187