Bug 1530569 - [abrt] Prevent passing NULL ldap handle into LDAP functions
Summary: [abrt] Prevent passing NULL ldap handle into LDAP functions
Keywords:
Status: CLOSED NEXTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: evolution-data-server
Version: 27
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Milan Crha
QA Contact: Fedora Extras Quality Assurance
URL: https://retrace.fedoraproject.org/faf...
Whiteboard: abrt_hash:cc262ee580ce445db2597569f27...
: 1537722 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-01-03 11:21 UTC by Peter Robinson
Modified: 2018-01-24 09:33 UTC (History)
8 users (show)

Fixed In Version: evolution-data-server-3.26.5
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-01-04 11:41:55 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: cgroup (371 bytes, text/plain)
2018-01-03 11:21 UTC, Peter Robinson
no flags Details
File: core_backtrace (16.90 KB, text/plain)
2018-01-03 11:21 UTC, Peter Robinson
no flags Details
File: cpuinfo (1.27 KB, text/plain)
2018-01-03 11:22 UTC, Peter Robinson
no flags Details
File: dso_list (19.56 KB, text/plain)
2018-01-03 11:22 UTC, Peter Robinson
no flags Details
File: environ (1.45 KB, text/plain)
2018-01-03 11:22 UTC, Peter Robinson
no flags Details
File: limits (1.29 KB, text/plain)
2018-01-03 11:22 UTC, Peter Robinson
no flags Details
File: maps (87.30 KB, text/plain)
2018-01-03 11:22 UTC, Peter Robinson
no flags Details
File: mountinfo (3.96 KB, text/plain)
2018-01-03 11:22 UTC, Peter Robinson
no flags Details
File: open_fds (809 bytes, text/plain)
2018-01-03 11:22 UTC, Peter Robinson
no flags Details
File: proc_pid_status (1.28 KB, text/plain)
2018-01-03 11:22 UTC, Peter Robinson
no flags Details

Description Peter Robinson 2018-01-03 11:21:26 UTC
Description of problem:
Just running evolution without connection to some accounts because VPN disconnected

Version-Release number of selected component:
evolution-data-server-3.26.3-1.fc27

Additional info:
reporter:       libreport-2.9.3
backtrace_rating: 4
cmdline:        /usr/libexec/evolution-addressbook-factory-subprocess --factory ldap --bus-name org.gnome.evolution.dataserver.Subprocess.Backend.AddressBookx8436x3 --own-path /org/gnome/evolution/dataserver/Subprocess/Backend/AddressBook/8436/3
crash_function: ldap_pvt_search
executable:     /usr/libexec/evolution-addressbook-factory-subprocess
journald_cursor: s=2dbb16bd5b8a40748e55cbc94c31d42a;i=3ae046;b=b68fd433afd54e64a3c12044af0780bd;m=88fafe2fb8;t=561db9959df74;x=ad65c3fc0b187b9d
kernel:         4.14.5-300.fc27.x86_64
rootdir:        /
runlevel:       N 5
type:           CCpp
uid:            1000

Comment 2 Peter Robinson 2018-01-03 11:21:48 UTC
Created attachment 1376286 [details]
File: cgroup

Comment 3 Peter Robinson 2018-01-03 11:21:56 UTC
Created attachment 1376287 [details]
File: core_backtrace

Comment 4 Peter Robinson 2018-01-03 11:22:01 UTC
Created attachment 1376288 [details]
File: cpuinfo

Comment 5 Peter Robinson 2018-01-03 11:22:10 UTC
Created attachment 1376289 [details]
File: dso_list

Comment 6 Peter Robinson 2018-01-03 11:22:16 UTC
Created attachment 1376290 [details]
File: environ

Comment 7 Peter Robinson 2018-01-03 11:22:21 UTC
Created attachment 1376291 [details]
File: limits

Comment 8 Peter Robinson 2018-01-03 11:22:35 UTC
Created attachment 1376292 [details]
File: maps

Comment 9 Peter Robinson 2018-01-03 11:22:41 UTC
Created attachment 1376293 [details]
File: mountinfo

Comment 10 Peter Robinson 2018-01-03 11:22:46 UTC
Created attachment 1376294 [details]
File: open_fds

Comment 11 Peter Robinson 2018-01-03 11:22:51 UTC
Created attachment 1376295 [details]
File: proc_pid_status

Comment 12 Milan Crha 2018-01-04 11:38:25 UTC
Thanks for a bug report. If I read the backtrace properly, the one of your LDAP address books decided to populate/refresh its cache, but it wasn't connected, which led to the crash, due to assert of "ld != NULL" in LDAP's ldap_pvt_search() function.

I guess it begun the local cache update when it had been connected (there's a code to not start cache update when it's not connected), but during the update the backend disconnected, which led to the crash due to insufficient checking of the connected state.

Related part of the backtrace:

Thread 1 (Thread 0x7f5a54e0af80 (LWP 8456)):
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
        set = {__val = {0, 94408559720128, 0, 140025721776511, 140028746235904, 94408559720128, 94408559720229, 94408559720128, 94408559720128, 94408559720231, 94408559720428, 94408559720128, 94408559720428, 0, 0, 0}}
        pid = <optimized out>
        tid = <optimized out>
#1  0x00007f5a47637381 in __GI_abort () at abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x7f5a2a812070, sa_sigaction = 0x7f5a2a812070}, sa_mask = {__val = {0, 6, 0, 0, 0, 140734020229944, 0, 140734020229776, 140025723012368, 21474836480, 140025722997672, 0, 14591080432356557568, 140025722982710, 0, 140025722997672}}, sa_flags = 363401078, sa_restorer = 0x7f5a15a968a8}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007f5a4762d8fa in __assert_fail_base (fmt=0x7f5a477a8ba8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x7f5a15a968a8 "ld != NULL", file=file@entry=0x7f5a15a90f76 "search.c", line=line@entry=95, function=function@entry=0x7f5a15a91060 <__PRETTY_FUNCTION__.8240> "ldap_pvt_search") at assert.c:92
        str = 0x7f5a2a812070 ""
        total = 4096
#3  0x00007f5a4762d972 in __GI___assert_fail (assertion=assertion@entry=0x7f5a15a968a8 "ld != NULL", file=file@entry=0x7f5a15a90f76 "search.c", line=line@entry=95, function=function@entry=0x7f5a15a91060 <__PRETTY_FUNCTION__.8240> "ldap_pvt_search") at assert.c:101
No locals.
#4  0x00007f5a15a649c9 in ldap_pvt_search (ld=ld@entry=0x0, base=0x55dd38a8e390 "...", scope=scope@entry=0, filter=filter@entry=0x0, attrs=attrs@entry=0x7fff31489dd0, attrsonly=attrsonly@entry=0, sctrls=0x0, cctrls=0x0, timeout=0x0, sizelimit=100, deref=-1, msgidp=0x7fff31489ca4) at search.c:95
        rc = <optimized out>
        ber = <optimized out>
        timelimit = <optimized out>
        id = 0
        __PRETTY_FUNCTION__ = "ldap_pvt_search"
#5  0x00007f5a15a64a6e in ldap_pvt_search_s (ld=0x0, base=<optimized out>, scope=scope@entry=0, filter=filter@entry=0x0, attrs=attrs@entry=0x7fff31489dd0, attrsonly=attrsonly@entry=0, sctrls=0x0, cctrls=0x0, timeout=0x0, sizelimit=100, deref=-1, res=0x7fff31489dc8) at search.c:174
        rc = <optimized out>
        msgid = 0
#6  0x00007f5a15a64b20 in ldap_search_ext_s (ld=<optimized out>, base=<optimized out>, scope=scope@entry=0, filter=filter@entry=0x0, attrs=attrs@entry=0x7fff31489dd0, attrsonly=attrsonly@entry=0, sctrls=0x0, cctrls=0x0, timeout=0x0, sizelimit=100, res=0x7fff31489dc8) at search.c:150
No locals.
#7  0x00007f5a15ebd7ba in build_contact_from_entry (bl=bl@entry=0x55dd326783d0, e=e@entry=0x55dd34321ae0, existing_objectclasses=existing_objectclasses@entry=0x0, ldap_uid=ldap_uid@entry=0x0) at /usr/src/debug/evolution-data-server-3.26.3-1.fc27.x86_64/src/addressbook/backends/ldap/e-book-backend-ldap.c:4051
        j = <optimized out>
        cn_values = <optimized out>
        grpattrs = {0x7f5a15ec3b2d "cn", 0x7f5a15ec3f41 "mail", 0x0}
        view_limit = <optimized out>
        count = 137
        book_view = 0x0
        ldap_error = <optimized out>
        result = 0x0
        email_values = <optimized out>
        member_info = 0x55dd38a8eea0
        i = 4
        info = 0x7f5a160c90e0 <prop_info+224>
        values = <optimized out>
        contact = 0x55dd34320050
        dn = <optimized out>
        attr = 0x55dd3431f870 "member"
        ber = 0x55dd3431f7d0
#8  0x00007f5a15ebe18f in generate_cache_handler (op=0x7f5a28162ec0, res=<optimized out>) at /usr/src/debug/evolution-data-server-3.26.3-1.fc27.x86_64/src/addressbook/backends/ldap/e-book-backend-ldap.c:4519
        contact = <optimized out>
        contact_list_op = 0x7f5a28162ec0
        bl = 0x55dd326783d0
        e = 0x55dd34321ae0
        msg_type = <optimized out>
        book_view = 0x0
        start = {tv_sec = 94408551818368, tv_usec = 94408551826272}
        end = {tv_sec = 0, tv_usec = -3855663641352994048}
        diff = <optimized out>
#9  0x00007f5a15ebe51e in poll_ldap (user_data=user_data@entry=0x55dd326783d0) at /usr/src/debug/evolution-data-server-3.26.3-1.fc27.x86_64/src/addressbook/backends/ldap/e-book-backend-ldap.c:4176

Comment 13 Milan Crha 2018-01-04 11:41:55 UTC
Created commit f6d2f340a in eds master (3.27.4+) [1]
Created commit 915b14e5d in eds gnome-3-26 (3.26.4+)

[1] https://git.gnome.org/browse/evolution-data-server/commit/?id=f6d2f340a

Comment 14 Peter Robinson 2018-01-04 12:06:25 UTC
(In reply to Milan Crha from comment #12)
> Thanks for a bug report. If I read the backtrace properly, the one of your
> LDAP address books decided to populate/refresh its cache, but it wasn't
> connected, which led to the crash, due to assert of "ld != NULL" in LDAP's
> ldap_pvt_search() function.
> 
> I guess it begun the local cache update when it had been connected (there's
> a code to not start cache update when it's not connected), but during the
> update the backend disconnected, which led to the crash due to insufficient
> checking of the connected state.

VPN had been disconnected for some time, but the laptop had been suspended at that point so it might have started before suspend when the VPN was up, but didn't notice the change properly once it resumed.

Comment 15 Milan Crha 2018-01-24 09:21:41 UTC
*** Bug 1537722 has been marked as a duplicate of this bug. ***

Comment 16 Milan Crha 2018-01-24 09:33:08 UTC
The bug #1537722 was filled with eds 3.26.4, which proves the change from
comment #13 was not enough. Looking closely into the place of the crash I see where I made a mistake, there had been two. Fixed for the next release.

Created commit d8f5e9bfc in eds master (3.27.90+) [2]
Created commit 332da1091 in eds gnome-3-26 (3.26.5+)

[2] https://git.gnome.org/browse/evolution-data-server/commit/?id=d8f5e9bfc


Note You need to log in before you can comment on or make changes to this bug.