Bug 1843838
Summary: | heap-use-after-free in slapi_be_getsuffix | ||
---|---|---|---|
Product: | Red Hat Enterprise Linux 8 | Reporter: | sgouvern |
Component: | 389-ds-base | Assignee: | mreynolds |
Status: | CLOSED ERRATA | QA Contact: | RHDS QE <ds-qe-bugs> |
Severity: | unspecified | Docs Contact: | |
Priority: | unspecified | ||
Version: | --- | CC: | pasik, spichugi, tbordaz, vashirov |
Target Milestone: | rc | Keywords: | TestCaseProvided, Triaged |
Target Release: | 8.0 | Flags: | pm-rhel:
mirror+
|
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | 389-ds-1.4-8040020201216214810.866effaa | Doc Type: | If docs needed, set a value |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2021-05-18 15:45:16 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
sgouvern
2020-06-04 09:26:39 UTC
The ASAN output has missing symbols. Could you please install the relevant debuginfo packages and rerun test again? dirsrvtests/tests/suites/disk_monitoring/disk_monitoring_test.py run with the asan build and all relevant debuginfo packages : ================================================================= ==283581==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000230850 at pc 0x7f7ebb729580 bp 0x7ffd60363f90 sp 0x7ffd60363f80 READ of size 4 at 0x611000230850 thread T0 #0 0x7f7ebb72957f in slapi_be_getsuffix (/usr/lib64/dirsrv/libslapd.so.0+0xd657f) #1 0x7f7eab6f60cb in ldbm_instance_search_config_entry_callback ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:759 #2 0x7f7ebb74f8c9 in dse_call_callback ldap/servers/slapd/dse.c:2646 #3 0x7f7ebb74fb04 in dse_write_entry ldap/servers/slapd/dse.c:1053 #4 0x7f7ebb8b93f3 in avl_inapply ldap/libraries/libavl/avl.c:484 #5 0x7f7ebb8b93d3 in avl_inapply ldap/libraries/libavl/avl.c:481 #6 0x7f7ebb8b93d3 in avl_inapply ldap/libraries/libavl/avl.c:481 #7 0x7f7ebb74ee81 in dse_write_file_nolock ldap/servers/slapd/dse.c:980 #8 0x7f7ebb7566ff in dse_replace_entry ldap/servers/slapd/dse.c:1295 #9 0x7f7ebb7566ff in dse_modify ldap/servers/slapd/dse.c:2019 #10 0x7f7ebb7d3973 in op_shared_modify ldap/servers/slapd/modify.c:1021 #11 0x7f7ebb7d5f58 (/usr/lib64/dirsrv/libslapd.so.0+0x182f58) #12 0x7f7ebb7d825b in slapi_modify_internal ldap/servers/slapd/modify.c:408 #13 0x7f7ebb8a470c in modify_state_entry ldap/servers/slapd/uuid.c:679 #14 0x7f7ebb8a499f in write_state_to_entry ldap/servers/slapd/uuid.c:603 #15 0x7f7ebb8a499f in write_state ldap/servers/slapd/uuid.c:561 #16 0x7f7ebb8a499f in uuid_cleanup ldap/servers/slapd/uuid.c:201 #17 0x560d27f3835e in slapd_daemon ldap/servers/slapd/daemon.c:1212 #18 0x560d27f14af2 in main (/usr/sbin/ns-slapd+0x30af2) #19 0x7f7eb80717b2 in __libc_start_main (/lib64/libc.so.6+0x237b2) #20 0x560d27f16ced in _start (/usr/sbin/ns-slapd+0x32ced) 0x611000230850 is located 144 bytes inside of 208-byte region [0x6110002307c0,0x611000230890) freed by thread T33 here: #0 0x7f7ebbcba7e0 in __interceptor_free (/lib64/libasan.so.5+0xef7e0) #1 0x7f7ebb73043c in slapi_ch_free (/usr/lib64/dirsrv/libslapd.so.0+0xdd43c) #2 0x7f7ebb72bd2f in slapi_be_free (/usr/lib64/dirsrv/libslapd.so.0+0xd8d2f) #3 0x560d27f31e17 in disk_monitoring_thread ldap/servers/slapd/daemon.c:712 #4 0x7f7eb901b567 in _pt_root ../../.././nspr/pr/src/pthreads/ptthread.c:201 previously allocated by thread T0 here: #0 0x7f7ebbcbadb0 in calloc (/lib64/libasan.so.5+0xefdb0) #1 0x7f7ebb730035 in slapi_ch_calloc (/usr/lib64/dirsrv/libslapd.so.0+0xdd035) #2 0x7f7ebb72b993 in slapi_be_new (/usr/lib64/dirsrv/libslapd.so.0+0xd8993) #3 0x7f7eab6f9126 in ldbm_instance_generate ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:889 #4 0x7f7eab6f9862 in ldbm_instance_add_instance_entry_callback ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:1108 #5 0x7f7eab6d15d7 in ldbm_config_read_instance_entries ldap/servers/slapd/back-ldbm/ldbm_config.c:1005 #6 0x7f7eab6d4d9e in ldbm_config_load_dse_info ldap/servers/slapd/back-ldbm/ldbm_config.c:1096 #7 0x7f7eab68360b in dblayer_setup ldap/servers/slapd/back-ldbm/dblayer.c:275 #8 0x7f7eab727ba9 in ldbm_back_start ldap/servers/slapd/back-ldbm/start.c:46 #9 0x7f7ebb810993 in plugin_call_func ldap/servers/slapd/plugin.c:2030 #10 0x7f7ebb817573 in plugin_call_one ldap/servers/slapd/plugin.c:1979 #11 0x7f7ebb817573 in plugin_dependency_startall ldap/servers/slapd/plugin.c:1733 #12 0x560d27f149c0 in main (/usr/sbin/ns-slapd+0x309c0) #13 0x7f7eb80717b2 in __libc_start_main (/lib64/libc.so.6+0x237b2) Thread T33 created by T0 here: #0 0x7f7ebbc1dea3 in __interceptor_pthread_create (/lib64/libasan.so.5+0x52ea3) #1 0x7f7eb901b23e in _PR_CreateThread ../../.././nspr/pr/src/pthreads/ptthread.c:433 SUMMARY: AddressSanitizer: heap-use-after-free (/usr/lib64/dirsrv/libslapd.so.0+0xd657f) in slapi_be_getsuffix Shadow bytes around the buggy address: 0x0c228003e0b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c228003e0c0: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c228003e0d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c228003e0e0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa 0x0c228003e0f0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd =>0x0c228003e100: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd 0x0c228003e110: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c228003e120: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c228003e130: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa 0x0c228003e140: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c228003e150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==283581==ABORTING This might have been indrectly fixed via: https://bugzilla.redhat.com/show_bug.cgi?id=1859225 (not in POST yet, but will be soon) openstack upgrade impacting the availability of a 1mt machine to test -> moving to ITM 6 # rpm -qa | grep 389 389-ds-base-debuginfo-1.4.3.16-4asan.el8.x86_64 python3-lib389-1.4.3.16-4asan.el8.noarch 389-ds-base-legacy-tools-debuginfo-1.4.3.16-4asan.el8.x86_64 389-ds-base-legacy-tools-1.4.3.16-4asan.el8.x86_64 389-ds-base-libs-1.4.3.16-4asan.el8.x86_64 389-ds-base-snmp-1.4.3.16-4asan.el8.x86_64 389-ds-base-debugsource-1.4.3.16-4asan.el8.x86_64 389-ds-base-1.4.3.16-4asan.el8.x86_64 389-ds-base-snmp-debuginfo-1.4.3.16-4asan.el8.x86_64 389-ds-base-libs-debuginfo-1.4.3.16-4asan.el8.x86_64 running # PYTHONPATH=src/lib389/ DISK_MONITORING_ACK=1 py.test -s -v dirsrvtests/tests/suites/disk_monitoring/disk_monitoring_test.py heap-use-after-free is still there in slapi_be_getsuffix ================================================================= ==276359==ERROR: AddressSanitizer: heap-use-after-free on address 0x6100002745c0 at pc 0x7fd14fbb97ac bp 0x7fff8bd1b810 sp 0x7fff8bd1b800 READ of size 4 at 0x6100002745c0 thread T0 #0 0x7fd14fbb97ab in slapi_be_getsuffix (/usr/lib64/dirsrv/libslapd.so.0+0xd67ab) #1 0x7fd13f90d497 in ldbm_instance_search_config_entry_callback ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:758 #2 0x7fd14fbdfca9 in dse_call_callback ldap/servers/slapd/dse.c:2667 #3 0x7fd14fbdfee4 in dse_write_entry ldap/servers/slapd/dse.c:1053 #4 0x7fd14fd4ae83 in avl_inapply ldap/libraries/libavl/avl.c:484 #5 0x7fd14fd4ae63 in avl_inapply ldap/libraries/libavl/avl.c:481 #6 0x7fd14fd4ae63 in avl_inapply ldap/libraries/libavl/avl.c:481 #7 0x7fd14fbdf261 in dse_write_file_nolock ldap/servers/slapd/dse.c:980 #8 0x7fd14fbe6b80 in dse_replace_entry ldap/servers/slapd/dse.c:1298 #9 0x7fd14fbe6b80 in dse_modify ldap/servers/slapd/dse.c:2024 #10 0x7fd14fc64283 in op_shared_modify ldap/servers/slapd/modify.c:1025 #11 0x7fd14fc669e8 (/usr/lib64/dirsrv/libslapd.so.0+0x1839e8) #12 0x7fd14fc68ceb in slapi_modify_internal ldap/servers/slapd/modify.c:408 #13 0x7fd14fd3617c in modify_state_entry ldap/servers/slapd/uuid.c:679 #14 0x7fd14fd3640f in write_state_to_entry ldap/servers/slapd/uuid.c:603 #15 0x7fd14fd3640f in write_state ldap/servers/slapd/uuid.c:561 #16 0x7fd14fd3640f in uuid_cleanup ldap/servers/slapd/uuid.c:201 #17 0x5653acea157e in slapd_daemon ldap/servers/slapd/daemon.c:1219 #18 0x5653ace7ddc6 in main (/usr/sbin/ns-slapd+0x30dc6) #19 0x7fd14c5028e2 in __libc_start_main (/lib64/libc.so.6+0x238e2) #20 0x5653ace7fffd in _start (/usr/sbin/ns-slapd+0x32ffd) 0x6100002745c0 is located 128 bytes inside of 192-byte region [0x610000274540,0x610000274600) freed by thread T25 here: #0 0x7fd15014c7e0 in __interceptor_free (/lib64/libasan.so.5+0xef7e0) #1 0x7fd14fbc052c in slapi_ch_free (/usr/lib64/dirsrv/libslapd.so.0+0xdd52c) #2 0x7fd14fbbbf3f in slapi_be_free (/usr/lib64/dirsrv/libslapd.so.0+0xd8f3f) #3 0x5653ace9b1e7 in disk_monitoring_thread ldap/servers/slapd/daemon.c:712 #4 0x7fd14d4ac5a7 (/lib64/libnspr4.so+0x2b5a7) previously allocated by thread T0 here: #0 0x7fd15014cdb0 in calloc (/lib64/libasan.so.5+0xefdb0) #1 0x7fd14fbc0125 in slapi_ch_calloc (/usr/lib64/dirsrv/libslapd.so.0+0xdd125) #2 0x7fd14fbbbba3 in slapi_be_new (/usr/lib64/dirsrv/libslapd.so.0+0xd8ba3) #3 0x7fd13f910338 in ldbm_instance_generate ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:887 #4 0x7fd13f910ac2 in ldbm_instance_add_instance_entry_callback ldap/servers/slapd/back-ldbm/ldbm_instance_config.c:1090 #5 0x7fd13f8e8837 in ldbm_config_read_instance_entries ldap/servers/slapd/back-ldbm/ldbm_config.c:1005 #6 0x7fd13f8ebffc in ldbm_config_load_dse_info ldap/servers/slapd/back-ldbm/ldbm_config.c:1096 #7 0x7fd13f89a3ab in dblayer_setup ldap/servers/slapd/back-ldbm/dblayer.c:275 #8 0x7fd13f940629 in ldbm_back_start ldap/servers/slapd/back-ldbm/start.c:46 #9 0x7fd14fca16a3 in plugin_call_func ldap/servers/slapd/plugin.c:2030 #10 0x7fd14fca8283 in plugin_call_one ldap/servers/slapd/plugin.c:1979 #11 0x7fd14fca8283 in plugin_dependency_startall ldap/servers/slapd/plugin.c:1733 #12 0x5653ace7dc94 in main (/usr/sbin/ns-slapd+0x30c94) #13 0x7fd14c5028e2 in __libc_start_main (/lib64/libc.so.6+0x238e2) Thread T25 created by T0 here: #0 0x7fd1500afea3 in __interceptor_pthread_create (/lib64/libasan.so.5+0x52ea3) #1 0x7fd14d4ac27e (/lib64/libnspr4.so+0x2b27e) SUMMARY: AddressSanitizer: heap-use-after-free (/usr/lib64/dirsrv/libslapd.so.0+0xd67ab) in slapi_be_getsuffix Shadow bytes around the buggy address: 0x0c2080046860: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c2080046870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa 0x0c2080046880: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c2080046890: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa 0x0c20800468a0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd =>0x0c20800468b0: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd 0x0c20800468c0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c20800468d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa 0x0c20800468e0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c20800468f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa 0x0c2080046900: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==276359==ABORTING marking FailedQA / ASSIGNED Upstream ticket: https://github.com/389ds/389-ds-base/issues/4483 With build 389-ds-base-1.4.3.16-8.1asan.el8.x86_64 running # PYTHONPATH=src/lib389/ DISK_MONITORING_ACK=1 ASAN=1 py.test -s -v dirsrvtests/tests/suites/disk_monitoring/disk_monitoring_test.py no heap-use-after-free is detected => marking as verified:tested wrong build attached to the errata -> moving to ITM12 Correct build now attached to the errata : as per comment 10, marking as VERIFIED and moving back to ITM11 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (389-ds:1.4 bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:1835 |