Bug 677588

Description of problem:


Version-Release number of selected component (if applicable):
sssd-1.5.1-5.el6.x86_64

How reproducible:
Always, with the specified sssd.conf I could reproduce this after every 3 successfully renewed TGT for user.

Steps to Reproduce:
1. Configure sssd for krb5 authentication.

relevant domain section of sssd.conf:
[domain/default]
krb5_lifetime = 120
ldap_tls_reqcert = demand
ldap_id_use_start_tls = False
krb5_realm = EXAMPLE.COM
ldap_search_base = dc=example,dc=com
debug_level = 9
id_provider = ldap
auth_provider = krb5
ldap_tls_cacert = /etc/openldap/cacerts/cacert.asc
chpass_provider = krb5
ldap_uri = ldaps://sssdldap.idm.lab.bos.redhat.com:636
krb5_renew_interval = 10
enumerate = False
krb5_kdcip = sssdldap.idm.lab.bos.redhat.com:88
cache_credentials = False
krb5_kpasswd = kerberos.example.com
krb5_renewable_lifetime = 150m
krb5_ccname_template = FILE:%d/krb5cc_%u
ldap_tls_cacertdir = /etc/openldap/cacerts
krb5_ccachedir = /tmp/krb5_cache

2. Login as a user.
3. Wait until the successful TGT renewals for more than 3 times.
  
Actual results:
sssd crashes

Expected results:
sssd should not crash.

Additional info:
[New Thread 3146]
[Thread debugging using libthread_db enabled]
Core was generated by `/usr/libexec/sssd/sssd_be -d 0 --debug-to-files --domain default'.
Program terminated with signal 6, Aborted.
#0  0x00007fcb8ac469e5 in raise () from /lib64/libc.so.6

Thread 1 (Thread 0x7fcb8e50f700 (LWP 3146)):
#0  0x00007fcb8ac469e5 in raise () from /lib64/libc.so.6
No symbol table info available.
#1  0x00007fcb8ac481c5 in abort () from /lib64/libc.so.6
No symbol table info available.
#2  0x00007fcb8dd01ddc in ?? () from /usr/lib64/libtalloc.so.2
No symbol table info available.
#3  0x00007fcb8dd02fbf in _talloc_steal_loc () from /usr/lib64/libtalloc.so.2
No symbol table info available.
#4  0x00007fcb826b4d08 in ?? () from /usr/lib64/sssd/libsss_krb5.so
No symbol table info available.
#5  0x00007fcb8df0d4e5 in ?? () from /usr/lib64/libtevent.so.0
No symbol table info available.
#6  0x00007fcb8df0f4e0 in ?? () from /usr/lib64/libtevent.so.0
No symbol table info available.
#7  0x00007fcb8df0c6d0 in _tevent_loop_once () from /usr/lib64/libtevent.so.0
No symbol table info available.
#8  0x00007fcb8df0c73b in ?? () from /usr/lib64/libtevent.so.0
No symbol table info available.
#9  0x0000000000431531 in server_loop ()
No symbol table info available.
#10 0x000000000040e84b in main ()
No symbol table info available.
From                To                  Syms Read   Shared Object Library
0x00007fcb8e1153a0  0x00007fcb8e11c158  Yes (*)     /lib64/libpam.so.0
0x00007fcb8df0c2d0  0x00007fcb8df108a8  Yes (*)     /usr/lib64/libtevent.so.0
0x00007fcb8dd01870  0x00007fcb8dd07a18  Yes (*)     /usr/lib64/libtalloc.so.2
0x00007fcb8daf8b10  0x00007fcb8dafdee8  Yes (*)     /lib64/libpopt.so.0
0x00007fcb8d8ca4a0  0x00007fcb8d8e9968  Yes (*)     /usr/lib64/libldb.so.0
0x00007fcb8d689090  0x00007fcb8d6b04c8  Yes (*)     /lib64/libdbus-1.so.3
0x00007fcb8d47c140  0x00007fcb8d47f5a8  Yes (*)     /lib64/librt.so.1
0x00007fcb8d24f540  0x00007fcb8d268e58  Yes (*)     /lib64/libpcre.so.0
0x00007fcb8d048740  0x00007fcb8d04c138  Yes (*)     /usr/lib64/libini_config.so.2
0x00007fcb8ce3df80  0x00007fcb8ce43958  Yes (*)     /usr/lib64/libcollection.so.2
0x00007fcb8cc38980  0x00007fcb8cc39b48  Yes (*)     /usr/lib64/libdhash.so.1
0x00007fcb8ca2d590  0x00007fcb8ca34848  Yes (*)     /lib64/liblber-2.4.so.2
0x00007fcb8c7ee050  0x00007fcb8c81a458  Yes (*)     /lib64/libldap-2.4.so.2
0x00007fcb8c5d3e30  0x00007fcb8c5dbc68  Yes (*)     /usr/lib64/libtdb.so.1
0x00007fcb8c3a5b90  0x00007fcb8c3c7ed8  Yes (*)     /usr/lib64/libssl3.so
0x00007fcb8c17b880  0x00007fcb8c1939c8  Yes (*)     /usr/lib64/libsmime3.so
0x00007fcb8be4f630  0x00007fcb8bf340a8  Yes (*)     /usr/lib64/libnss3.so
0x00007fcb8bc20560  0x00007fcb8bc2b7e8  Yes (*)     /usr/lib64/libnssutil3.so
0x00007fcb8ba15ea0  0x00007fcb8ba16d58  Yes (*)     /lib64/libplds4.so
0x00007fcb8b8123d0  0x00007fcb8b813b08  Yes (*)     /lib64/libplc4.so
0x00007fcb8b5e0f90  0x00007fcb8b600758  Yes (*)     /lib64/libnspr4.so
0x00007fcb8b3bc640  0x00007fcb8b3c7f28  Yes (*)     /lib64/libpthread.so.0
0x00007fcb8b1b3de0  0x00007fcb8b1b4998  Yes (*)     /lib64/libdl.so.2
0x00007fcb8afa5ed0  0x00007fcb8afb01a8  Yes (*)     /usr/lib64/libcares.so.2
0x00007fcb8ac329e0  0x00007fcb8ad50830  Yes (*)     /lib64/libc.so.6
0x00007fcb8a9ff500  0x00007fcb8aa04c28  Yes (*)     /lib64/libaudit.so.1
0x00007fcb8a7c6c00  0x00007fcb8a7cb9a8  Yes (*)     /lib64/libcrypt.so.1
0x00007fcb8e320af0  0x00007fcb8e3387b4  Yes (*)     /lib64/ld-linux-x86-64.so.2
0x00007fcb8a5c3c80  0x00007fcb8a5c4ee8  Yes (*)     /usr/lib64/libpath_utils.so.1
0x00007fcb8a3c18d0  0x00007fcb8a3c2158  Yes (*)     /usr/lib64/libref_array.so.1
0x00007fcb8a1aa8c0  0x00007fcb8a1b9558  Yes (*)     /lib64/libresolv.so.2
0x00007fcb89f916a0  0x00007fcb89fa1408  Yes (*)     /usr/lib64/libsasl2.so.2
0x00007fcb89d79ef0  0x00007fcb89d851a8  Yes (*)     /lib64/libz.so.1
0x00007fcb89b19270  0x00007fcb89b58928  Yes (*)     /lib64/libfreebl3.so
0x00007fcb83a7b270  0x00007fcb83a81b78  Yes (*)     /usr/lib64/ldb/memberof.so
0x00007fcb8381f300  0x00007fcb8385f468  Yes (*)     /usr/lib64/sssd/libsss_ldap.so
0x00007fcb8354f550  0x00007fcb835c4638  Yes (*)     /lib64/libkrb5.so.3
0x00007fcb8330d780  0x00007fcb83327778  Yes (*)     /lib64/libk5crypto.so.3
0x00007fcb831073b0  0x00007fcb83107f88  Yes (*)     /lib64/libcom_err.so.2
0x00007fcb82efe7a0  0x00007fcb82f03898  Yes (*)     /lib64/libkrb5support.so.0
0x00007fcb82cfabc0  0x00007fcb82cfb1a8  Yes (*)     /lib64/libkeyutils.so.1
0x00007fcb82ae06f0  0x00007fcb82af0a28  Yes (*)     /lib64/libselinux.so.1
0x00007fcb828d0110  0x00007fcb828d80b8  Yes (*)     /lib64/libnss_files.so.2
0x00007fcb826aaff0  0x00007fcb826c5708  Yes (*)     /usr/lib64/sssd/libsss_krb5.so
0x00007fcb824a1f80  0x00007fcb824a4638  Yes (*)     /lib64/libnss_sss.so.2
0x00007fcb8229c000  0x00007fcb8229f338  Yes (*)     /lib64/libnss_dns.so.2
0x00007fcb82061a70  0x00007fcb8208ca78  Yes (*)     /usr/lib64/libsoftokn3.so
0x00007fcb81dd6ae0  0x00007fcb81e427a8  Yes (*)     /usr/lib64/libsqlite3.so.0
0x00007fcb81baa160  0x00007fcb81bc6b88  Yes (*)     /usr/lib64/libnssdbm3.so
0x00007fcb819767a0  0x00007fcb81994868  Yes (*)     /usr/lib64/libnsspem.so
(*): Shared library is missing debugging information.
$1 = 0x0
No symbol table is loaded.  Use the "file" command.
rax            0x0	0
rbx            0x7fcb8dd07bc0	140512234339264
rcx            0xffffffffffffffff	-1
rdx            0x6	6
rsi            0xc4a	3146
rdi            0xc4a	3146
rbp            0x2452ba0	0x2452ba0
rsp            0x7fffb76c9208	0x7fffb76c9208
r8             0x38	56
r9             0x101010101010101	72340172838076673
r10            0x8	8
r11            0x202	514
r12            0x0	0
r13            0x0	0
r14            0x2452ba0	38087584
r15            0x0	0
rip            0x7fcb8ac469e5	0x7fcb8ac469e5 <raise+53>
eflags         0x202	[ IF ]
cs             0x33	51
ss             0x2b	43
ds             0x0	0
es             0x0	0
fs             0x0	0
gs             0x0	0
Dump of assembler code for function raise:
   0x00007fcb8ac469b0 <+0>:	mov    %fs:0x2d4,%eax
   0x00007fcb8ac469b8 <+8>:	mov    %fs:0x2d0,%esi
   0x00007fcb8ac469c0 <+16>:	test   %esi,%esi
   0x00007fcb8ac469c2 <+18>:	jne    0x7fcb8ac469f0 <raise+64>
   0x00007fcb8ac469c4 <+20>:	mov    $0xba,%eax
   0x00007fcb8ac469c9 <+25>:	syscall 
   0x00007fcb8ac469cb <+27>:	mov    %eax,%esi
   0x00007fcb8ac469cd <+29>:	mov    %eax,%fs:0x2d0
   0x00007fcb8ac469d5 <+37>:	movslq %edi,%rdx
   0x00007fcb8ac469d8 <+40>:	movslq %esi,%rsi
   0x00007fcb8ac469db <+43>:	movslq %eax,%rdi
   0x00007fcb8ac469de <+46>:	mov    $0xea,%eax
   0x00007fcb8ac469e3 <+51>:	syscall 
=> 0x00007fcb8ac469e5 <+53>:	cmp    $0xfffffffffffff000,%rax
   0x00007fcb8ac469eb <+59>:	ja     0x7fcb8ac469ff <raise+79>
   0x00007fcb8ac469ed <+61>:	repz retq 
   0x00007fcb8ac469ef <+63>:	nop
   0x00007fcb8ac469f0 <+64>:	test   %eax,%eax
   0x00007fcb8ac469f2 <+66>:	jg     0x7fcb8ac469d5 <raise+37>
   0x00007fcb8ac469f4 <+68>:	test   $0x7fffffff,%eax
   0x00007fcb8ac469f9 <+73>:	jne    0x7fcb8ac46a0f <raise+95>
   0x00007fcb8ac469fb <+75>:	mov    %esi,%eax
   0x00007fcb8ac469fd <+77>:	jmp    0x7fcb8ac469d5 <raise+37>
   0x00007fcb8ac469ff <+79>:	mov    0x35759a(%rip),%rdx        # 0x7fcb8af9dfa0
   0x00007fcb8ac46a06 <+86>:	neg    %eax
   0x00007fcb8ac46a08 <+88>:	mov    %eax,%fs:(%rdx)
   0x00007fcb8ac46a0b <+91>:	or     $0xffffffffffffffff,%eax
   0x00007fcb8ac46a0e <+94>:	retq   
   0x00007fcb8ac46a0f <+95>:	neg    %eax
   0x00007fcb8ac46a11 <+97>:	jmp    0x7fcb8ac469d5 <raise+37>
End of assembler dump.