freeipa

#9914 AddressSanitizer: SEGV ipa-pwd-extop/common.c:584 in ipapwd_gen_checks
Closed: fixed by sumenon. Opened by rcritten.

Closed: fixed
Reopen Issue

Issue

Cloned from https://issues.redhat.com/browse/RHEL-138570

From https://issues.redhat.com/browse/RHEL-119339
ipa-4.12.2-14

=================================================================
==2651358==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x7faacd7343ea bp 0x7faa6a6e2f48 sp 0x7faa6a6e2e60 T31)
==2651358==The signal is caused by a READ memory access.
==2651358==Hint: address points to the zero page.
    #0 0x7faacd7343ea in ipapwd_gen_checks /usr/src/debug/ipa-4.12.2-14.2.TESTBUILD.RHEL119339.el9_6.x86_64/daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c:584
    #1 0x7faacd73d8c0 in ipapwd_pre_bind /usr/src/debug/ipa-4.12.2-14.2.TESTBUILD.RHEL119339.el9_6.x86_64/daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c:1531
    #2 0x7faad29370a4 in plugin_call_func ldap/servers/slapd/plugin.c:1996
    #3 0x7faad2937345 in plugin_call_list ldap/servers/slapd/plugin.c:1939
    #4 0x556f4d3dab9c in do_bind ldap/servers/slapd/bind.c:644
    #5 0x556f4d3e0832 in connection_dispatch_operation ldap/servers/slapd/connection.c:633
    #6 0x556f4d3e0832 in connection_threadmain ldap/servers/slapd/connection.c:1925
    #7 0x7faad2b7abd3 in _pt_root (/lib64/libnspr4.so+0x2cbd3)
    #8 0x7faad248a199 in start_thread (/lib64/libc.so.6+0x8a199)
    #9 0x7faad250f0ff in clone3 (/lib64/libc.so.6+0x10f0ff)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /usr/src/debug/ipa-4.12.2-14.2.TESTBUILD.RHEL119339.el9_6.x86_64/daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c:584 in ipapwd_gen_checks
Thread T31 created by T0 here:
    #0 0x7faad2c587d5 in pthread_create (/usr/lib64/libasan.so.6+0x587d5)
    #1 0x7faad2b7aeba in _PR_CreateThread (/lib64/libnspr4.so+0x2ceba)
==2651358==ABORTING

In https://github.com/freeipa/freeipa/blob/1d2897e3d7cc88c2c5698126ecb1e59fff396bbc/daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c#L574-L587
there is a missing goto done; after the NULL check:

    /* get the kerberos context and master key */
    *config = ipapwd_getConfig();
    if (NULL == *config) {
        LOG_FATAL("Error Retrieving Master Key\n");
        *errMesg = "Fatal Internal Error";
        rc = LDAP_OPERATIONS_ERROR;
    }
    /* do not return the master key if asked */
    if (check_flags & IPAPWD_CHECK_ONLY_CONFIG) {
        free((*config)->kmkey->contents); // *config is NULL -> SEGV
        free((*config)->kmkey);
    (*config)->kmkey = NULL;
    }

Steps to Reproduce

  1. Install IPA server
  2. Add a user with a password
  3. Editdaemons/ipa-slapi-plugins/ipa-pwd-extop/common.c and add config = NULL; after *config = ipapwd_getConfig(); around line 581.

Actual behavior

This will force it to continue to the next block which will try to manipulate *config and fail with a core dump.

# coredumpctl list
TIME                            PID UID GID SIG     COREFILE EXE                SIZE
Tue 2026-01-06 14:16:43 EST 1212614 389 389 SIGSEGV present  /usr/sbin/ns-slapd   4M

As the reporter, Viktor, pointed out. Adding a goto done; at the end of the NULL == *config conditional will resolve the issue.

https://github.com/freeipa/freeipa/pull/8085

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-138570

master:

  • 79efc82911cbcfaffd8430d14efabd372c6ec44e ipa-pwd-extop: Don't manipulate the config if not retrieved

ipa-4-13:

  • d6f7c0b14c7211b603b47e8fe3851ba0197ed38c ipa-pwd-extop: Don't manipulate the config if not retrieved

ipa-4-11:

  • d2c9edf8b21127e1144d17fccb14c404363222d2 ipa-pwd-extop: Don't manipulate the config if not retrieved

ipa-4-10:

  • 6b9fc731526ded81d2949921d174ee48eafc0260 ipa-pwd-extop: Don't manipulate the config if not retrieved

ipa-4-12:

  • 53e568b8c5b0cd82568863cf582054244bf734d3 ipa-pwd-extop: Don't manipulate the config if not retrieved

Metadata Update from @sumenon:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Normal
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.