Bug 2019888 - Winbindd crashes after NULL pointer dereference - missing return value check in winbindd_util.c:fill_domain_username_talloc()
Summary: Winbindd crashes after NULL pointer dereference - missing return value check ...
Keywords:
Status: CLOSED NEXTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: samba
Version: 7.9
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: Andreas Schneider
QA Contact: sssd-qe
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-11-03 14:43 UTC by Josef Lusticky
Modified: 2021-12-01 10:53 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-12-01 10:53:16 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
CentOS 18344 0 None None None 2021-11-03 14:43:51 UTC
Red Hat Issue Tracker RHELPLAN-103468 0 None None None 2021-11-21 17:55:33 UTC

Description Josef Lusticky 2021-11-03 14:43:51 UTC
Winbindd crashes in strlower_m() called from winbindd_util.c:fill_domain_username_talloc() -see the following backtrace:

=============
Program terminated with signal 6, Aborted.
#0 0x00007fab86b09387 in raise () from /lib64/libc.so.6

#0 0x00007fab86b09387 in raise () from /lib64/libc.so.6
#1 0x00007fab86b0aa78 in abort () from /lib64/libc.so.6
#2 0x00007fab91ebc679 in dump_core () at ../../source3/lib/dumpcore.c:338
#3 0x00007fab91ea1ec8 in smb_panic_s3 (why=<optimized out>) at ../../source3/lib/util.c:847
#4 0x00007fab954cc11d in smb_panic (why=why@entry=0x7fab954dcf39 "internal error") at ../../lib/util/fault.c:174
#5 0x00007fab954cc37e in fault_report (sig=<optimized out>) at ../../lib/util/fault.c:88
#6 sig_fault (sig=11) at ../../lib/util/fault.c:99
#7 <signal handler called>
#8 strlower_m (s=s@entry=0x0) at ../../source3/lib/util_str.c:452
#9 0x000055e7fb359709 in fill_domain_username_talloc (mem_ctx=mem_ctx@entry=0x55e7fcb8a810, domain=0x55e7fcb93d80 "HG", user=<optimized out>, can_assume=can_assume@entry=true) at ../../source3/winbindd/winbindd_util.c:1672
#10 0x000055e7fb391371 in wb_query_user_list_done (subreq=<optimized out>) at ../../source3/winbindd/wb_query_user_list.c:110
#11 0x00007fab92eb3dd1 in dcerpc_binding_handle_call_done (subreq=0x55e7fcb957e0) at ../../librpc/rpc/binding_handle.c:520
#12 0x000055e7fb381fdd in wbint_bh_raw_call_domain_done (subreq=0x55e7fcb966d0) at ../../source3/winbindd/winbindd_dual_ndr.c:204
#13 0x000055e7fb37fa8c in wb_domain_request_done (subreq=0x55e7fcb96a30) at ../../source3/winbindd/winbindd_dual.c:708
#14 0x000055e7fb37dc5d in wb_child_request_done (subreq=0x55e7fcb970a0) at ../../source3/winbindd/winbindd_dual.c:273
#15 0x000055e7fb34e6a7 in wb_simple_trans_read_done (subreq=0x55e7fcb973e0) at ../../nsswitch/wb_reqtrans.c:432
#16 0x000055e7fb34deff in wb_resp_read_done (subreq=0x55e7fcb97710) at ../../nsswitch/wb_reqtrans.c:275
#17 0x00007fab87fcfb13 in tevent_common_invoke_fd_handler () from /lib64/libtevent.so.0
#18 0x00007fab87fd6087 in epoll_event_loop_once () from /lib64/libtevent.so.0
#19 0x00007fab87fd4057 in std_event_loop_once () from /lib64/libtevent.so.0
#20 0x00007fab87fcf25d in _tevent_loop_once () from /lib64/libtevent.so.0
#21 0x000055e7fb3464b8 in main (argc=<optimized out>, argv=<optimized out>) at ../../source3/winbindd/winbindd.c:1912

=============

(gdb) frame 9
#9 0x000055e7fb359709 in fill_domain_username_talloc (mem_ctx=mem_ctx@entry=0x55e7fcb8a810, domain=0x55e7fcb93d80 "HG", user=<optimized out>, can_assume=can_assume@entry=true) at ../../source3/winbindd/winbindd_util.c:1672
1672 if (!strlower_m(tmp_user)) {
(gdb) l
1667 if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC) {
1668 can_assume = false;
1669 }
1670
1671 tmp_user = talloc_strdup(mem_ctx, user);
1672 if (!strlower_m(tmp_user)) {
1673 TALLOC_FREE(tmp_user);
1674 return NULL;
1675 }
1676
(gdb) info locals
tmp_user = 0x0
name = <optimized out>

=============

gdb shows that strlower_m() functions gets NULL pointer from tmp_user value, which is returned from talloc_strdup() at LINE 1671
but it is not checked against NULL before passing to strlower_m().

Affected CentOS 7 version:
samba-winbind-4.10.16-15.el7_9.x86_64

NOTE:
The check against NULL value is also absent in the current git sources of winbind_util.c.
Please report upstream.

NOTE:
Reported on CentOS bugzilla.

Comment 3 mpanaous 2021-11-23 14:52:26 UTC
Hello,

my name is Marios from the IDM support team. May I ask please to raise a support case as to capture properly the issue and the debug logs?

Afterwards please share here the case number. We will make sure the case will be attached to the bug as expected. 
It will be easier and much faster to work based on the expected procedures

Best Regards,

Marios Panaousis
Red Hat EMEA

Comment 4 Andreas Schneider 2021-12-01 10:53:16 UTC
This will be addressed in RHEL 8 and RHEL 9. Thanks for reporting.


Note You need to log in before you can comment on or make changes to this bug.