RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2214638 - Interrupt request processing in ipadb_fill_info3() if connection to 389ds is lost [rhel-8]
Summary: Interrupt request processing in ipadb_fill_info3() if connection to 389ds is ...
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: ipa
Version: 8.7
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Julien Rische
QA Contact: Ganna Kaihorodova
: 2228943 (view as bug list)
Depends On:
Blocks: 2227831 2227832 2230073
TreeView+ depends on / blocked
Reported: 2023-06-13 17:20 UTC by Prasad Kulkarni
Modified: 2024-03-14 04:25 UTC (History)
19 users (show)

Fixed In Version: ipa-4.9.12-6.module+el8.9.0+19634+c162f948
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 2227831 2227832 2230073 (view as bug list)
Last Closed: 2023-11-14 15:32:53 UTC
Type: Bug
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Fedora Pagure freeipa issue 9422 0 None None None 2023-07-31 11:43:39 UTC
Github freeipa freeipa pull 6929 0 None open ipa-kdb: fix error handling of is_master_host() 2023-07-31 11:48:30 UTC
Red Hat Issue Tracker FREEIPA-10013 0 None None None 2023-06-13 17:28:42 UTC
Red Hat Issue Tracker RHELPLAN-159738 0 None None None 2023-06-13 17:28:55 UTC
Red Hat Product Errata RHBA-2023:6977 0 None None None 2023-11-14 15:33:31 UTC

Comment 1 Rob Crittenden 2023-06-13 17:53:31 UTC
The crash is happening in the ipa kdb code. Changing components.

The ld connection is NULL, hence the failure.

Did this fail in a particular context? e.g. under load, a specific Kerberos request?

Comment 3 Rob Crittenden 2023-06-13 19:43:10 UTC
Alexander thinks this may be upstream issue https://pagure.io/freeipa/issue/9251 . We lost traction with an upstream user who had a reproducing system.

Comment 6 Têko Mihinto 2023-07-03 17:33:35 UTC
Hi Rob,

(In reply to Rob Crittenden from comment #1)
> The crash is happening in the ipa kdb code. Changing components.
> The ld connection is NULL, hence the failure.
> Did this fail in a particular context? e.g. under load, a specific Kerberos
> request?

Customer mentioned that this typically happens when the LDAP server is under load
( addition / deletion of new hosts triggering multiple and replicated changes ).


Comment 12 Julien Rische 2023-07-26 10:03:25 UTC
This crash is due to the is_master_host() function[1], which is called in ipadb_fill_info3()[2] as part of the process to populate the PAC.

is_master_host() searches for a master host entry using ipadb_simple_search()[3], and interprets an error as the absence of master entry, and the absence of error as a the presence of a master entry. Hence, a connection error would be misinterpreted.

The crash occurs because in case ipadb_simple_search() faces a connection issue during the query, it will try to reset the connection to run the query again. But if it fails to reset the connection, it returns with an error code right away, leaving the LDAP context uninitialized. But, as mentioned above, is_master_host() won't handle this as an actual error. So the process in ipadb_fill_info3() will continue until the ldap_get_entry_controls() call, where the process crashes because of the uninitialized LDAP context.

[1] https://github.com/freeipa/freeipa/blob/release-4-9-12/daemons/ipa-kdb/ipa_kdb_mspac.c#L404
[2] https://github.com/freeipa/freeipa/blob/release-4-9-12/daemons/ipa-kdb/ipa_kdb_mspac.c#L695-L697
[3] https://github.com/freeipa/freeipa/blob/release-4-9-12/daemons/ipa-kdb/ipa_kdb_common.c#L169

Comment 14 Julien Rische 2023-07-31 11:43:36 UTC
Upstream ticket:

Comment 15 Julien Rische 2023-07-31 11:48:31 UTC
Upstream pull request:

Comment 16 Florence Blanc-Renaud 2023-08-01 11:36:31 UTC
Fixed upstream

Comment 18 Julien Rische 2023-08-04 12:22:02 UTC
*** Bug 2228943 has been marked as a duplicate of this bug. ***

Comment 27 Andy Heath 2023-08-08 18:44:27 UTC
Is thier any way to get a backport hotfix, our IDM servers are running into this issue causing intermittency connection issues for users to their systems. This is blocking upgrades and releases as Automation job and update scripts and playbooks require that stable connectivity.

Comment 35 errata-xmlrpc 2023-11-14 15:32:53 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (idm:client and idm:DL1 bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Comment 36 Red Hat Bugzilla 2024-03-14 04:25:49 UTC
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days

Note You need to log in before you can comment on or make changes to this bug.