Bug 14353 - segfault in krb5_free_context (via cli_session_setup_gensec_local_next)
Summary: segfault in krb5_free_context (via cli_session_setup_gensec_local_next)
Status: RESOLVED DUPLICATE of bug 14344
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: libsmbclient (show other bugs)
Version: 4.11.5
Hardware: All Linux
: P5 normal (vote)
Target Milestone: ---
Assignee: Samba QA Contact
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-04-21 09:30 UTC by Sam Morris
Modified: 2020-04-22 07:24 UTC (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam Morris 2020-04-21 09:30:05 UTC

    
Comment 1 Sam Morris 2020-04-21 09:33:47 UTC
Forwarded from: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=941493

When I run 'smbclient -k //server.example.com/share' with KRB5CCNAME=KCM: or KRB5CCNAME=KEYRING:user:12345 I get this crash:

  Failed to resolve credential cache 'KCM:'! (Unknown credential cache type)
  free(): double free detected in tcache 2
  Aborted (core dumped)

Here's a backtrace...

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff744e55b in __GI_abort () at abort.c:79
#2  0x00007ffff74a7008 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff75b3f3e "%s\n") at ../sysdeps/posix/libc_fatal.c:181
#3  0x00007ffff74ae3aa in malloc_printerr (str=str@entry=0x7ffff75b5b90 "free(): double free detected in tcache 2") at malloc.c:5339
#4  0x00007ffff74b01ed in _int_free (av=0x7ffff75e5b80 <main_arena>, p=0x555555590ba0, have_lock=0) at malloc.c:4201
#5  0x00007ffff6af4925 in krb5_free_context (context=0x5555555cba10) at ../../source4/heimdal/lib/krb5/context.c:595
#6  0x00007ffff721748d in gse_context_destructor (ptr=ptr@entry=0x5555555aa350) at ../../source3/librpc/crypto/gse.c:84
#7  0x00007ffff77224de in _tc_free_internal (tc=0x5555555aa2f0, location=0x7ffff7228da0 "../../source3/librpc/crypto/gse.c:241") at ../../talloc.c:1157
#8  0x00007ffff721812c in gse_context_init (mem_ctx=mem_ctx@entry=0x5555555cb980, do_sign=<optimized out>, do_seal=<optimized out>, add_gss_c_flags=<optimized out>, _gse_ctx=_gse_ctx@entry=0x7fffffffce00, ccache_name=<optimized out>) at ../../source3/librpc/crypto/gse.c:241
#9  0x00007ffff72182f3 in gse_init_client (ccache_name=0x0, realm=<optimized out>, username=<optimized out>, password=<optimized out>, _gse_ctx=<synthetic pointer>, add_gss_c_flags=<optimized out>, service=0x5555555ca0d0 "cifs", server=0x5555555ca4d0 "server.example.com", do_seal=<optimized out>, do_sign=<optimized out>, mem_ctx=0x5555555cb980) at ../../source3/librpc/crypto/gse.c:268
#10 gensec_gse_client_start (gensec_security=0x5555555cb980) at ../../source3/librpc/crypto/gse.c:786
#11 0x00007ffff71f25a3 in gensec_start_mech (gensec_security=0x5555555cb980) at ../../auth/gensec/gensec_start.c:743
#12 gensec_start_mech (gensec_security=0x5555555cb980) at ../../auth/gensec/gensec_start.c:704
#13 0x00007ffff71ef97e in gensec_spnego_client_negTokenInit_step (gensec_security=0x5555555c6ad0, spnego_state=0x5555555c9530, n=0x5555555cb050, spnego_in=<optimized out>, last_status=..., in_mem_ctx=<optimized out>, in_next=0x5555555cafa8) at ../../auth/gensec/spnego.c:633
#14 0x00007ffff71eff5e in gensec_spnego_client_negTokenInit_start (gensec_security=0x5555555c6ad0, spnego_state=0x5555555c9530, n=0x5555555cb050, spnego_in=0x5555555caf18, in_mem_ctx=0x5555555caef0, in_next=0x5555555cafa8) at ../../auth/gensec/spnego.c:537
#15 0x00007ffff71f0cc4 in gensec_spnego_update_pre (req=0x5555555cad40) at ../../auth/gensec/spnego.c:1943
#16 gensec_spnego_update_send (mem_ctx=<optimized out>, ev=0x5555555ade90, gensec_security=<optimized out>, in=...) at ../../auth/gensec/spnego.c:1741
#17 0x00007ffff71f1508 in gensec_update_send (mem_ctx=<optimized out>, ev=0x5555555ade90, gensec_security=0x5555555c6ad0, in=...) at ../../auth/gensec/gensec.c:449
#18 0x00007ffff7d01586 in cli_session_setup_gensec_local_next (req=0x5555555c5ae0) at ../../source3/libsmb/cliconnect.c:997
#19 0x00007ffff7d02f00 in cli_session_setup_gensec_send (target_service=0x7ffff7d37b0e "cifs", target_hostname=0x5555555c21f0 "server.example.com", creds=0x5555555acf90, cli=0x5555555acf90, ev=0x5555555ade90, mem_ctx=<optimized out>) at ../../source3/libsmb/cliconnect.c:977
#20 cli_session_setup_spnego_send (creds=0x5555555acf90, cli=0x5555555acf90, ev=0x5555555ade90, mem_ctx=<optimized out>) at ../../source3/libsmb/cliconnect.c:1346
#21 cli_session_setup_creds_send (mem_ctx=mem_ctx@entry=0x5555555ade90, ev=ev@entry=0x5555555ade90, cli=cli@entry=0x5555555acf90, creds=creds@entry=0x5555555b3370) at ../../source3/libsmb/cliconnect.c:1505
#22 0x00007ffff7d0368d in cli_session_setup_creds (cli=0x5555555acf90, creds=creds@entry=0x5555555b3370) at ../../source3/libsmb/cliconnect.c:1843
#23 0x00007ffff7d1fe57 in do_connect (ctx=ctx@entry=0x5555555a9e90, server=<optimized out>, server@entry=0x0, share=share@entry=0x5555555befd0 "\\\\server.example.com\\share", auth_info=0x5555555b32e0, force_encrypt=<optimized out>, max_protocol=max_protocol@entry=13, port=0, name_type=32, pcli=0x7fffffffd1a0) at ../../source3/libsmb/clidfs.c:236
#24 0x00007ffff7d203a8 in cli_cm_connect (ctx=ctx@entry=0x5555555a9e90, referring_cli=referring_cli@entry=0x0, server=server@entry=0x0, share=share@entry=0x5555555befd0 "\\\\server.example.com\\share", auth_info=<optimized out>, force_encrypt=force_encrypt@entry=false, max_protocol=13, port=0, name_type=32, pcli=0x7fffffffd200) at ../../source3/libsmb/clidfs.c:339
#25 0x00007ffff7d2052f in cli_cm_open (ctx=0x5555555a9e90, referring_cli=0x0, server=0x0, share=0x5555555befd0 "\\\\server.example.com\\share", auth_info=<optimized out>, force_encrypt=<optimized out>, max_protocol=13, port=0, name_type=32, pcli=0x55555557b398 <cli>) at ../../source3/libsmb/clidfs.c:441
#26 0x000055555555e1c8 in process (base_directory=0x0) at ../../source3/client/client.c:6705
#27 main (argc=<optimized out>, argv=<optimized out>) at ../../source3/client/client.c:6705
Comment 2 Stefan Metzmacher 2020-04-22 07:24:23 UTC

*** This bug has been marked as a duplicate of bug 14344 ***