Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1796470

Summary: Invalid provider value causes sssd crash
Product: Red Hat Enterprise Linux 8 Reporter: Amith <apeetham>
Component: sssdAssignee: Alexey Tikhonov <atikhono>
Status: CLOSED DUPLICATE QA Contact: sssd-qe <sssd-qe>
Severity: urgent Docs Contact:
Priority: unspecified    
Version: 8.2CC: atikhono, grajaiya, jhrozek, lslebodn, mzidek, pbrezina, tscherf
Target Milestone: rcKeywords: Regression
Target Release: 8.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-01-30 17:31:39 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
SSSD Domain log
none
GDB core dump gzip file none

Description Amith 2020-01-30 13:59:56 UTC
Created attachment 1656501 [details]
SSSD Domain log

Description of problem:
Invalid id_provider value in domain section causes SSSD crash. This is one of the negative cases in our sanity test suite. We observed consistent failures in our regression rounds. I suspect this crash is one of the reasons for test failure.

Version-Release number of selected component (if applicable):
sssd-2.2.3-11.el8.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Configure domain section of sssd.conf as given below:

[domain/LOCAL]
id_provider = invalidprovider
enumerate = True
 
2. Restart SSSD service and monitor the process. It crashes.

# systemctl restart sssd; systemctl status sssd
Job for sssd.service failed because a fatal signal was delivered causing the control process to dump core.
See "systemctl status sssd.service" and "journalctl -xe" for details.
● sssd.service - System Security Services Daemon
   Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: enabled)
   Active: activating (auto-restart) (Result: core-dump) since Thu 2020-01-30 19:25:15 IST; 19ms ago
  Process: 30008 ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER} (code=dumped, signal=ABRT)
 Main PID: 30008 (code=dumped, signal=ABRT)

Jan 30 19:25:15 vm-idm-013.lab.eng.pnq.redhat.com systemd[1]: sssd.service: Main process exited, code=dumped, status=6/ABRT
Jan 30 19:25:15 vm-idm-013.lab.eng.pnq.redhat.com systemd[1]: sssd.service: Failed with result 'core-dump'.
Jan 30 19:25:15 vm-idm-013.lab.eng.pnq.redhat.com systemd[1]: Failed to start System Security Services Daemon.


3. Run the following command to monitor sssd_be process every 2 seconds. 

# watch 'pgrep -l sssd_be >> res ; echo "-------" >> res; tail -n 20 res'
27773 sssd_be
-------
27773 sssd_be
-------
27773 sssd_be
-------
27812 sssd_be
-------
27812 sssd_be
-------
27812 sssd_be
-------
27848 sssd_be
-------
27848 sssd_be


Actual results:
sssd process crashes every 6 seconds.

Expected results:
SSSD service should fail to start but should not crash.

Additional info:
Attached the domain log file.

Comment 1 Alexey Tikhonov 2020-01-30 14:45:13 UTC
Please provide backtrace/coredump

Comment 3 Amith 2020-01-30 15:23:16 UTC
Sure, i will provide backtrace / core dump. However, i would like to add additional info to this bug.

 - If we keep id_provider set to an invalid value and also update enumerate to a negative value then strangely SSSD service works fine.

 - Configure domain section as follows:

[domain/LOCAL]
id_provider = invalidprovider
debug_level = 0xFFF0
enumerate = -4563

 - Now restart SSSD service and check the status.

# systemctl restart sssd; systemctl status sssd
● sssd.service - System Security Services Daemon
   Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2020-01-30 20:39:02 IST; 27ms ago
 Main PID: 32186 (sssd)
    Tasks: 4
   Memory: 34.1M
   CGroup: /system.slice/sssd.service
           ├─32186 /usr/sbin/sssd -i --logger=files
           ├─32187 /usr/libexec/sssd/sssd_be --domain implicit_files --uid 0 --gid 0 --logger=files
           ├─32188 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
           └─32189 /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --logger=files

Jan 30 20:39:01 vm-idm-013.lab.eng.pnq.redhat.com sssd[32186]: Error (22 [Invalid argument]) retrieving domain [LOCAL], skipping!
Jan 30 20:39:01 vm-idm-013.lab.eng.pnq.redhat.com sssd[32186]: Starting up
Jan 30 20:39:01 vm-idm-013.lab.eng.pnq.redhat.com sssd[32186]: Error (22 [Invalid argument]) retrieving domain [LOCAL], skipping!
Jan 30 20:39:01 vm-idm-013.lab.eng.pnq.redhat.com sssd[be[implicit_files]][32187]: Starting up
Jan 30 20:39:01 vm-idm-013.lab.eng.pnq.redhat.com sssd[be[implicit_files]][32187]: Error (22 [Invalid argument]) retrieving domain [LOCAL], skipping!
Jan 30 20:39:01 vm-idm-013.lab.eng.pnq.redhat.com sssd[nss][32188]: Starting up
Jan 30 20:39:01 vm-idm-013.lab.eng.pnq.redhat.com sssd[pam][32189]: Starting up
Jan 30 20:39:01 vm-idm-013.lab.eng.pnq.redhat.com sssd[pam][32189]: Error (22 [Invalid argument]) retrieving domain [LOCAL], skipping!
Jan 30 20:39:01 vm-idm-013.lab.eng.pnq.redhat.com sssd[nss][32188]: Error (22 [Invalid argument]) retrieving domain [LOCAL], skipping!
Jan 30 20:39:02 vm-idm-013.lab.eng.pnq.redhat.com systemd[1]: Started System Security Services Daemon.


NOTE: Even though id_provider is invalid, the SSSD process SUCCESSFULLY restarts with minor errors only when ENUMERATE also has invalid value assigned to it.
If we revert the configuration back to "enumerate = True" and restart SSSD service, we see the crash again.

Comment 4 Amith 2020-01-30 17:16:59 UTC
BACKTRACE FULL:
--------------------------------------------------------------------------------------------

(gdb) bt full
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
        set = {__val = {4224, 124554051605, 3, 7017895662250634240, 2336912227651905620, 3689356507010314291, 140728902037562, 7017895662250634240, 140732614940176, 94526666174016, 94526666182592, 
            94526666183136, 0, 140075373629807, 94526666011328, 140075381480662}}
        pid = <optimized out>
        tid = <optimized out>
        ret = <optimized out>
#1  0x00007f65d5ecab25 in __GI_abort () at abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 0, 1, 140075419811344, 140075367011085, 0, 140075371339616, 206158430224, 140732614940656, 140732614940592, 
              94526666173920, 140075373621637, 140075371339616, 0, 140732614940704, 94526666173920}}, sa_flags = -578447296, sa_restorer = 0x7f65d6e3116f}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007f65d67dade0 in talloc_abort (reason=0x7f65d67e8a88 "Bad talloc magic value - unknown value") at ../../talloc.c:505
No locals.
#3  0x00007f65d67daf2a in talloc_abort_unknown_value () at ../../talloc.c:534
No locals.
#4  talloc_chunk_from_ptr (ptr=0x55f8b45c0fc0) at ../../talloc.c:534
        pp = 0x55f8b45c0fc0 ""
        tc = 0x55f8b45c0f60
        pp = <optimized out>
        tc = <optimized out>
#5  __talloc_get_name (ptr=0x55f8b45c0fc0) at ../../talloc.c:1559
        tc = <optimized out>
        tc = <optimized out>
#6  talloc_check_name (ptr=ptr@entry=0x55f8b45c0fc0, name=name@entry=0x7f65d9a564e5 "struct sss_ptr_hash_value") at ../../talloc.c:1582
        pname = <optimized out>
#7  0x00007f65d9a3b731 in sss_ptr_hash_check_type (ptr=0x55f8b45c0fc0, type=0x7f65d9a564e5 "struct sss_ptr_hash_value") at src/util/sss_ptr_hash.c:31
        type_ptr = <optimized out>
        __FUNCTION__ = "sss_ptr_hash_check_type"
        __debug_macro_level = <optimized out>
#8  0x00007f65d9a3b80d in sss_ptr_hash_lookup_internal (table=<optimized out>, key=key@entry=0x55f8b45c11e0 "sssd.domain_implicit_5ffiles") at src/util/sss_ptr_hash.c:273
        table_value = {type = HASH_VALUE_PTR, {ptr = 0x55f8b45c0fc0, i = -1269035072, ui = 3025932224, l = 94526666182592, ul = 94526666182592, f = -2.04948265e-07, d = 4.6702378376722236e-310}}
        table_key = {type = HASH_KEY_STRING, {str = 0x55f8b45c11e0 "sssd.domain_implicit_5ffiles", c_str = 0x55f8b45c11e0 "sssd.domain_implicit_5ffiles", ul = 94526666183136}}
        hret = <optimized out>
        __FUNCTION__ = "sss_ptr_hash_lookup_internal"
#9  0x00007f65d9a3bc62 in _sss_ptr_hash_lookup (table=<optimized out>, key=key@entry=0x55f8b45c11e0 "sssd.domain_implicit_5ffiles", type=type@entry=0x7f65d6e3116f "struct sbus_connection")
    at src/util/sss_ptr_hash.c:286
        value = <optimized out>
#10 0x00007f65d6e2d33f in sbus_server_connection_has_name (server=0x55f8b459b5d0, name=0x55f8b45c11e0 "sssd.domain_implicit_5ffiles", conn=0x55f8b45972c0) at src/sbus/server/sbus_server_match.c:439
        named_conn = <optimized out>
        named_conn = <optimized out>
#11 sbus_server_matchmaker (server=server@entry=0x55f8b459b5d0, conn=conn@entry=0x0, avoid_name=0x55f8b45c11e0 "sssd.domain_implicit_5ffiles", message=message@entry=0x55f8b45c2220)
    at src/sbus/server/sbus_server_match.c:439
        __item = 0x55f8b45c88b0
        list = <optimized out>
        match_conn = 0x55f8b45972c0
        has_name = <optimized out>
#12 0x00007f65d6e2d69f in sbus_server_name_owner_changed (server=0x55f8b459b5d0, name=<optimized out>, new_owner=<optimized out>, old_owner=<optimized out>) at src/sbus/server/sbus_server.c:536
        message = 0x55f8b45c2220
        __FUNCTION__ = "sbus_server_name_owner_changed"
        __debug_macro_level = <optimized out>
#13 0x00007f65d9a3b62f in sss_ptr_hash_delete_cb (item=0x55f8b45c1150, deltype=HASH_ENTRY_DESTROY, pvt=<optimized out>) at src/util/sss_ptr_hash.c:162
--Type <RET> for more, q to quit, c to continue without paging--
        data = 0x55f8b459b210
        value = <optimized out>
        callback_entry = {key = {type = HASH_KEY_STRING, {str = 0x55f8b45c11e0 "sssd.domain_implicit_5ffiles", c_str = 0x55f8b45c11e0 "sssd.domain_implicit_5ffiles", ul = 94526666183136}}, value = {
            type = HASH_VALUE_PTR, {ptr = 0x55f8b45bc3f0, i = -1269054480, ui = 3025912816, l = 94526666163184, ul = 94526666163184, f = -2.0467246e-07, d = 4.6702378367133409e-310}}}
        __FUNCTION__ = "sss_ptr_hash_delete_cb"
#14 0x00007f65d6c02d7d in hash_delete (table=table@entry=0x55f8b4593e20, key=key@entry=0x7ffedd8599f0) at dhash/dhash.c:1077
        error = <optimized out>
        element = 0x55f8b45c1150
        chain = 0x55f8b45c0340
#15 0x00007f65d9a3bd86 in sss_ptr_hash_delete (free_value=false, key=0x55f8b45c10c0 "sssd.domain_implicit_5ffiles", table=0x55f8b4593e20) at src/util/sss_ptr_hash.c:348
        value = <optimized out>
        table_key = {type = HASH_KEY_STRING, {str = 0x55f8b45c10c0 "sssd.domain_implicit_5ffiles", c_str = 0x55f8b45c10c0 "sssd.domain_implicit_5ffiles", ul = 94526666182848}}
        hret = <optimized out>
        ptr = 0x55f8b45bc3f0
        value = <optimized out>
        table_key = <optimized out>
        hret = <optimized out>
        ptr = <optimized out>
        __FUNCTION__ = "sss_ptr_hash_delete"
        __debug_macro_level = <optimized out>
#16 sss_ptr_hash_delete (table=0x55f8b4593e20, key=0x55f8b45c10c0 "sssd.domain_implicit_5ffiles", free_value=<optimized out>) at src/util/sss_ptr_hash.c:323
        value = <optimized out>
        table_key = <optimized out>
        hret = <optimized out>
        ptr = <optimized out>
        __FUNCTION__ = "sss_ptr_hash_delete"
        __debug_macro_level = <optimized out>
#17 0x00007f65d9a3be31 in sss_ptr_hash_spy_destructor (spy=spy@entry=0x55f8b45c1040) at src/util/sss_ptr_hash.c:64
No locals.
#18 0x00007f65d67e1c50 in _tc_free_internal (location=0x7f65d6e30d78 "src/sbus/connection/sbus_connection.c:438", tc=0x55f8b45c0fe0) at ../../talloc.c:1157
        d = 0x7f65d9a3be10 <sss_ptr_hash_spy_destructor>
        ptr_to_free = <optimized out>
        ptr = <optimized out>
        ptr_to_free = <optimized out>
        ptr = <optimized out>
        is_child = <optimized out>
        d = <optimized out>
        pool = <optimized out>
        _flen = <optimized out>
        _fptr = <optimized out>
#19 _tc_free_children_internal (location=<optimized out>, ptr=<optimized out>, tc=<optimized out>) at ../../talloc.c:1666
        child = <optimized out>
        new_parent = <optimized out>
        child = 0x55f8b45c1040
        new_parent = 0x0
        child = <optimized out>
        new_parent = <optimized out>
        p = <optimized out>
        p = <optimized out>
#20 talloc_free_children (ptr=<optimized out>) at ../../talloc.c:1712
        tc_name = <optimized out>
--Type <RET> for more, q to quit, c to continue without paging--
        tc = <optimized out>
#21 0x00007f65d67dd034 in _tc_free_internal (location=0x7f65d6e30d78 "src/sbus/connection/sbus_connection.c:438", tc=0x55f8b45bc390) at ../../talloc.c:1183
        ptr_to_free = <optimized out>
        ptr = 0x55f8b45bc3f0
        ptr_to_free = <optimized out>
        ptr = <optimized out>
        is_child = <optimized out>
        d = <optimized out>
        pool = <optimized out>
        _flen = <optimized out>
        _fptr = <optimized out>
#22 _talloc_free_internal (location=0x7f65d6e30d78 "src/sbus/connection/sbus_connection.c:438", ptr=0x55f8b45bc3f0) at ../../talloc.c:1247
        tc = 0x55f8b45bc390
        tc = <optimized out>
        fill = <optimized out>
#23 _talloc_free (ptr=0x55f8b45bc3f0, location=0x7f65d6e30d78 "src/sbus/connection/sbus_connection.c:438") at ../../talloc.c:1789
        tc = 0x55f8b45bc390
#24 0x00007f65d69f93b9 in tevent_common_invoke_timer_handler (te=te@entry=0x55f8b45bad80, current_time=..., removed=removed@entry=0x0) at ../../tevent_timed.c:370
        handler_ev = 0x55f8b45a2140
#25 0x00007f65d69f955e in tevent_common_loop_timer_delay (ev=ev@entry=0x55f8b45a2140) at ../../tevent_timed.c:442
        current_time = {tv_sec = 1580403787, tv_usec = 852322}
        te = 0x55f8b45bad80
        ret = <optimized out>
#26 0x00007f65d69f682f in poll_event_loop_once (location=<optimized out>, ev=0x55f8b45a2140) at ../../tevent_poll.c:621
        tval = {tv_sec = 0, tv_usec = 0}
        tval = <optimized out>
#27 poll_event_loop_once (ev=0x55f8b45a2140, location=<optimized out>) at ../../tevent_poll.c:602
        tval = <optimized out>
#28 0x00007f65d69f3b15 in _tevent_loop_once (ev=ev@entry=0x55f8b45a2140, location=location@entry=0x7f65d9a51659 "src/util/server.c:719") at ../../tevent.c:772
        ret = <optimized out>
        nesting_stack_ptr = 0x0
#29 0x00007f65d69f3dbb in tevent_common_loop_wait (ev=0x55f8b45a2140, location=0x7f65d9a51659 "src/util/server.c:719") at ../../tevent.c:895
        ret = <optimized out>
#30 0x00007f65d9a2f927 in server_loop (main_ctx=0x55f8b4592940) at src/util/server.c:719
No locals.
#31 0x000055f8b28f375e in main (argc=<optimized out>, argv=<optimized out>) at src/monitor/monitor.c:2612
        opt = <optimized out>
        pc = <optimized out>
        opt_daemon = 0
        opt_interactive = 1
        opt_genconf = 0
        opt_version = 0
        opt_netlinkoff = 0
        opt_config_file = 0x0
        opt_logger = 0x55f8b455d790 "files"
        config_file = <optimized out>
        opt_genconf_section = 0x0
        flags = <optimized out>
        main_ctx = 0x55f8b4592940
        tmp_ctx = 0x55f8b457e530
        monitor = 0x55f8b457ec00
--Type <RET> for more, q to quit, c to continue without paging--
        ret = 0
        uid = <optimized out>
        long_options = {{longName = 0x0, shortName = 0 '\000', argInfo = 4, arg = 0x55f8b2b011a0 <poptHelpOptions>, val = 0, descrip = 0x55f8b28fce47 "Help options:", argDescrip = 0x0}, {
            longName = 0x55f8b28fce55 "debug-level", shortName = 100 'd', argInfo = 2, arg = 0x55f8b2b012a8 <debug_level>, val = 0, descrip = 0x55f8b28fce61 "Debug level", argDescrip = 0x0}, {
            longName = 0x55f8b28fce6d "debug-to-files", shortName = 102 'f', argInfo = 1073741824, arg = 0x55f8b2b01184 <debug_to_file>, val = 0, 
            descrip = 0x55f8b28fbb98 "Send the debug output to files instead of stderr", argDescrip = 0x0}, {longName = 0x55f8b28fce7c "debug-to-stderr", shortName = 0 '\000', argInfo = 1073741824, 
            arg = 0x55f8b2b01180 <debug_to_stderr>, val = 0, descrip = 0x55f8b28fbbd0 "Send the debug output to stderr directly.", argDescrip = 0x0}, {longName = 0x55f8b28fce8c "debug-timestamps", 
            shortName = 0 '\000', argInfo = 2, arg = 0x55f8b2b01260 <debug_timestamps>, val = 0, descrip = 0x55f8b28fce9d "Add debug timestamps", argDescrip = 0x0}, {
            longName = 0x55f8b28fceb2 "debug-microseconds", shortName = 0 '\000', argInfo = 2, arg = 0x55f8b2b01280 <debug_microseconds>, val = 0, descrip = 0x55f8b28fbc00 "Show timestamps with microseconds", 
            argDescrip = 0x0}, {longName = 0x55f8b28fcec9 "logger", shortName = 0 '\000', argInfo = 1, arg = 0x7ffedd859c80, val = 0, descrip = 0x55f8b28fcec5 "Set logger", 
            argDescrip = 0x55f8b28fced0 "stderr|files|journald"}, {longName = 0x55f8b28fcee6 "daemon", shortName = 68 'D', argInfo = 0, arg = 0x7ffedd859c64, val = 0, 
            descrip = 0x55f8b28fceed "Become a daemon (default)", argDescrip = 0x0}, {longName = 0x55f8b28fcf07 "interactive", shortName = 105 'i', argInfo = 0, arg = 0x7ffedd859c68, val = 0, 
            descrip = 0x55f8b28fbc28 "Run interactive (not a daemon)", argDescrip = 0x0}, {longName = 0x55f8b28fcf13 "disable-netlink", shortName = 0 '\000', argInfo = 1073741824, arg = 0x7ffedd859c74, 
            val = 0, descrip = 0x55f8b28fcf23 "Disable netlink interface", argDescrip = 0x0}, {longName = 0x55f8b28fe657 "config", shortName = 99 'c', argInfo = 1, arg = 0x7ffedd859c78, val = 0, 
            descrip = 0x55f8b28fbc48 "Specify a non-default config file", argDescrip = 0x0}, {longName = 0x55f8b28fcf3d "genconf", shortName = 103 'g', argInfo = 0, arg = 0x7ffedd859c6c, val = 0, 
            descrip = 0x55f8b28fbc70 "Refresh the configuration database, then exit", argDescrip = 0x0}, {longName = 0x55f8b28fcf45 "genconf-section", shortName = 115 's', argInfo = 1, arg = 0x7ffedd859c88, 
            val = 0, descrip = 0x55f8b28fbca0 "Similar to --genconf, but only refreshes the given section", argDescrip = 0x0}, {longName = 0x55f8b28fe62f "version", shortName = 0 '\000', argInfo = 0, 
            arg = 0x7ffedd859c70, val = 0, descrip = 0x55f8b28fcf55 "Print version number and exit", argDescrip = 0x0}, {longName = 0x0, shortName = 0 '\000', argInfo = 0, arg = 0x0, val = 0, descrip = 0x0, 
            argDescrip = 0x0}}
        __FUNCTION__ = "main"
(gdb) 
(gdb) 
(gdb) 
(gdb) 
(gdb) 
(gdb)

Comment 5 Amith 2020-01-30 17:18:16 UTC
Created attachment 1656543 [details]
GDB core dump gzip file

Comment 6 Alexey Tikhonov 2020-01-30 17:31:39 UTC
Thank you. I confirm this is duplicate of bz 1792331.

*** This bug has been marked as a duplicate of bug 1792331 ***