Bug 606584

Hmm, could you please provide the coredump? Either attach it here if it is small or put it somewhere where I can download it. Or even better would be if your could provide the Perl application that segfaults for you so that I can reproduce the problem.

Created attachment 363016 [details]
core file

Created attachment 363017 [details]
perl script

I stripped most of the perl code not needed to get the segfault and generated the attached core file. If you want to reproduce, you'll need your own ldap server.

I was looking into the core file but I couldn't tell much from it (somehow gdb was confused when I tried to inspect required functions, address whose access supposedly cause SISGSEGV was accessible etc.). So I've tried reproducing the problem. I've installed Authen::Krb5::Easy module. Somehow kinit() wasn't really working complaining that:
could not get initial credentials: Key table entry not found

I guess it's because the key in /etc/krb5.keytab isn't really for jack@SUSE.CZ which is what I've configured as ad_user and ad_domain for our ldap server. So I've obtained kerberos ticket manually, set script to use created cache file, and commented out kinit() call. But now I'm getting:

First parameter was not a reference. It was type 5
Use of uninitialized value in numeric ne (!=) at ./bug-606584_co.pm line 55, <DATA> line 275.
Usage: Authen::SASL::Cyrus::client_new(pkg, parent, service, host, ...) at /usr/lib/perl5/vendor_perl/5.10.0/Net/LDAP.pm line 389, <DATA> line 275.
 at ./bug-606584_co.pm line 57
Usage: Authen::SASL::Cyrus::client_new(pkg, parent, service, host, ...) at /usr/lib/perl5/vendor_perl/5.10.0/Net/LDAP.pm line 389, <DATA> line 275.

So was I too naive in working around kerberos or is there some other problem with your script? It seems as if
  $sasl_conn = $sasl->client_new("ldap",$ad_server);
failed without initializing sasl_conn.

BTW: I've also dug in krb5 library and by any chance, don't you have self-compiled krb5 libraries?

No, I use the distribution's krb5 libraries.
I installed e2fsprogs-debugsource package to get the remove_error_table function source code from /usr/src/debug/e2fsprogs-1.41.11/lib/et/error_message.c
I saw in the code that I could add debugging with:
export COMERR_DEBUG=1
Here is the output of "perl co.pm" :
access ad
10.48.3.11
add_error_table: krb5 (0x0x7f3b5e0cd540)
add_error_table: kv5m (0x0x7f3b5e0cdd60)
add_error_table: kdb5 (0x0x7f3b5e0cd3c0)
add_error_table: asn1 (0x0x7f3b5e0cd320)
add_error_table: k524 (0x0x7f3b5e0cdf80)
add_error_table: prof (0x0x7f3b5e0d1160)
add_error_table: ggss (0x0x7f3b5bcc17c0)
add_error_table: ggss (0x0x7f3b5bcc17c0)
remove_error_table FAILED: k5g (0x0x7f3b5bcc1a00)
remove_error_table: ggss (0x0x7f3b5bcc17c0)
Segmentation fault
It seems to segfault when trying  to remove a third "error_table"

I'm investigating exactly the same segmentation fault in AutoFS (bug #608295). I did some tests here and identified that the problem doesn't exist on openSUSE 11.1, which uses Kerberos 1.6.3. openSUSE 11.2 (Kerberos 1.7.6) and current Factory (Kerberos 1.8.1) are affected.

I also confirmed that updating Kerberos to version 1.7.6 on openSUSE 11.1 is enough to make the problem appear.

Thanks Michael and Leonardo for input. I think I now see where's the problem. Krb5 library seems to add ggss table twice. That causes that ggss table is referenced twice from the list of all error tables and after it is freed, we reference freed memory from a list causing SEGFAULT during the next removal.

Reassigning to krb5 packager.

Michel, please, can you test the Kerberos packages now available in this repository?

http://download.opensuse.org/repositories/home:/leonardocf:/branches:/openSUSE:/11.2:/Update:/Test/standard/

It includes a patch that hopefully addresses this problem.

For reference, this bug was reported upstream in:

http://mailman.mit.edu/pipermail/krbdev/2010-June/009099.html

And the patch is now committed to Kerberos repository:

http://anonsvn.mit.edu/viewvc/krb5/trunk/src/lib/gssapi/krb5/gssapi_krb5.c?r1=24050&r2=24139

yes, this fixes the problem for me. Thanks

Thanks for testing, Michel. I submitted the fix to Factory (request id 41854), hopefully it will be included in 11.3.

Submitted to Factory

I would suggest to put this together with the next security update for krb5 to openSUSE 11.2 .

*** Bug 608295 has been marked as a duplicate of this bug. ***

yes, please roll into the next security update (which will likely come ;)

Done. Submitted together with Bug 650650

This is an autogenerated message for OBS integration:
This bug (606584) was mentioned in
https://build.opensuse.org/request/show/41864 Factory / krb5
https://build.opensuse.org/request/show/54232 11.2:Test / krb5