SV: Re: Freeradius stops authenticating
Svein Hansen
Svein.Hansen at hive.no
Mon Nov 7 14:59:02 CET 2005
I recompiled freeradius with the patch, but the problem didn't go away..
I have 2 new outputs from valgrind and a stacktrace from gbd, but I don't want to send attachments to the list.
Here's some lines from the output's..
Run 1: Valgrind
# valgrind --tool=memcheck --verbose --log-file=/root/val071105 radiusd -yf
---
==32260== Thread 8:
==32260== Invalid write of size 4
==32260== at 0x7D64E8: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so)
==32260== by 0x1BB78CB2: ??? (rlm_passwd.c:308)
==32260== by 0xFC53: modcall (modcall.c:219)
==32260== by 0xFEE0: modcall (modcall.c:252)
==32260== Address 0x1BB57078 is 0 bytes inside a block of size 352 free'd
==32260== at 0x1B904EA5: free (vg_replace_malloc.c:153)
==32260== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so)
==32260== by 0x1BB77DFA: ??? (rlm_passwd.c:285)
==32260== by 0x1BB78C12: ??? (rlm_passwd.c:545)
==32260==
==32260== Thread 8:
==32260== Invalid free() / delete / delete[]
==32260== at 0x1B904EA5: free (vg_replace_malloc.c:153)
==32260== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so)
==32260== by 0x1BB78CB2: ??? (rlm_passwd.c:308)
==32260== by 0xFC53: modcall (modcall.c:219)
==32260== Address 0x1BB57078 is 0 bytes inside a block of size 352 free'd
==32260== at 0x1B904EA5: free (vg_replace_malloc.c:153)
==32260== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so)
==32260== by 0x1BB77DFA: ??? (rlm_passwd.c:285)
==32260== by 0x1BB78C12: ??? (rlm_passwd.c:545)
Run 2: Valgrind
# valgrind --tool=memcheck --verbose --log-file=/root/val071105 radiusd -yf
-----
==9390== Thread 8:
==9390== Invalid write of size 4
==9390== at 0x7D64E8: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so)
==9390== by 0x1BB78CB2: ??? (rlm_passwd.c:308)
==9390== by 0xFC53: modcall (modcall.c:219)
==9390== by 0xFEE0: modcall (modcall.c:252)
==9390== Address 0x1BB371C8 is 0 bytes inside a block of size 352 free'd
==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153)
==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so)
==9390== by 0x1BB77DFA: ??? (rlm_passwd.c:285)
==9390== by 0x1BB78CA3: ??? (rlm_passwd.c:309)
==9390==
==9390== Thread 8:
==9390== Invalid free() / delete / delete[]
==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153)
==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so)
==9390== by 0x1BB78CB2: ??? (rlm_passwd.c:308)
==9390== by 0xFC53: modcall (modcall.c:219)
==9390== Address 0x1BB371C8 is 0 bytes inside a block of size 352 free'd
==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153)
==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so)
==9390== by 0x1BB77DFA: ??? (rlm_passwd.c:285)
==9390== by 0x1BB78CA3: ??? (rlm_passwd.c:309)
==9390==
==9390== Thread 9:
==9390== Invalid read of size 1
==9390== at 0x7D6BFA: _IO_fgets (in /lib/tls/libc-2.3.4.so)
==9390== by 0x1BB77DA0: ??? (rlm_passwd.c:275)
==9390== by 0x1BB78C12: ??? (rlm_passwd.c:545)
==9390== by 0xFC53: modcall (modcall.c:219)
==9390== Address 0x1BB68F31 is 1 bytes inside a block of size 352 free'd
==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153)
==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so)
==9390== by 0x1BB78CB2: ??? (rlm_passwd.c:308)
==9390== by 0xFC53: modcall (modcall.c:219)
Run 3: gdb
# radiusd -yf
Mon Nov 7 13:02:31 2005 : Info: Starting - reading configuration files ...
*** glibc detected *** malloc(): memory corruption: 0xae8012dd ***
Aborted (core dumped)
# date
man nov 7 14:19:20 CET 2005
# gdb radiusd core.19991
(gdb) bt
#0 0x00bbb7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1 0x003127d5 in raise () from /lib/tls/libc.so.6
#2 0x00314149 in abort () from /lib/tls/libc.so.6
#3 0x0034640a in __libc_message () from /lib/tls/libc.so.6
#4 0x0034d51c in _int_malloc () from /lib/tls/libc.so.6
#5 0x0034ef81 in malloc () from /lib/tls/libc.so.6
#6 0x0011915b in pairmake (attribute=0x947af33 "LM-Password", value=0x947ab03 "", operator=11)
at valuepair.c:1041
#7 0x00e09981 in addresult (inst=0x947a9e8, vp=0x947d954, pw=0x947aac8, when=0 '\0',
listname=0xe09e76 "config_items") at rlm_passwd.c:504
#8 0x00e09bbc in passwd_authorize (instance=0x947a9e8, request=0x947d940) at rlm_passwd.c:542
#9 0x001f2c54 in modcall (component=1, c=0x9479b18, request=0x947d940) at modcall.c:219
#10 0x001f2ee1 in modcall (component=1, c=0x93fb260, request=0x947d940) at modcall.c:252
#11 0x001f2126 in indexed_modcall (comp=1, idx=6, request=0x0) at modules.c:473
#12 0x001eeef3 in rad_authenticate (request=0x947d940) at auth.c:592
#13 0x001e804c in rad_respond (request=0x947d940, fun=0x1eee57 <rad_authenticate>) at radiusd.c:1642
#14 0x001f5481 in request_handler_thread (arg=0x947d378) at threads.c:517
#15 0x006c5341 in start_thread () from /lib/tls/libpthread.so.0
#16 0x003b26fe in clone () from /lib/tls/libc.so.6
(gdb)
My rlm_passwd.c (after applying patch):
Line: 279 - 289
if(!strcmp(list, name)) return passwd;
}
}
}
}
fclose(ht->fp);
ht->fp = NULL;
return NULL;
#undef passwd
}
Line:301 - 311
if (!strcmp(hashentry->field[ht->keyfield], name)){
/* save address of next item to check into buffer */
ht->last_found=hashentry->next;
return hashentry;
}
return NULL;
}
if (ht->fp) fclose(ht->fp);
if (!(ht->fp=fopen(ht->filename, "r"))) return NULL;
return get_next(name, ht);
}
Line: 540 - 550
}
do {
addresult(inst, &request->config_items, pw, 0, "config_items");
addresult(inst, &request->reply->vps, pw, 1, "reply_items");
addresult(inst, &request->packet->vps, pw, 2, "request_items");
} while ( (pw = get_next(name, inst->ht)) );
found++;
if (!inst->allowmultiple) break;
}
if(!found) {
return RLM_MODULE_NOTFOUND;
Please send me an email if you can help me, and I will send the complete outputs.
Svein Hansen
>>> nbk at sitadelle.com 27.10.2005 12:34:41 >>>
Svein Hansen wrote:
> I suspected that there had to be a module in freeradius that makes
> glibc fault, so I tried to run freeradius in Valgrind:
Thanks, the output of Valgrind is very useful.
> I'm not a programmer, but can it be that radius tries a double-close
> or a double-free?
Indeed, it looks like a file stream is closed more than once.
Please try to apply these changes to src/modules/rlm_passwd/rlm_passwd.c
then recompile FreeRADIUS and test again.
Index: src/modules/rlm_passwd/rlm_passwd.c
===================================================================
RCS file: /source/radiusd/src/modules/rlm_passwd/rlm_passwd.c,v
retrieving revision 1.13.2.3
diff -u -r1.13.2.3 rlm_passwd.c
--- src/modules/rlm_passwd/rlm_passwd.c 19 Dec 2004 20:06:30 -0000 1.13.2.3
+++ src/modules/rlm_passwd/rlm_passwd.c 27 Oct 2005 10:23:00 -0000
@@ -136,8 +136,15 @@
for (i=0; i<ht->tablesize; i++)
if (ht->table[i])
destroy_password(ht->table[i]);
- if (ht->table) free(ht->table);
- if (ht->fp) fclose(ht->fp);
+ if (ht->table) {
+ free(ht->table);
+ ht->table = NULL:
+ }
+ if (ht->fp) {
+ fclose(ht->fp);
+ ht->fp = NULL;
+ }
+ ht->tablesize = 0;
}
static void release_ht(struct hashtable * ht){
@@ -194,7 +201,6 @@
if(*buffer && *buffer!='\n' && (!ignorenis || (*buffer != '+' && *buffer != '-')) ){
if(!(hashentry = mypasswd_malloc(buffer, nfields, &len))){
release_hash_table(ht);
- ht->tablesize = 0;
return ht;
}
len = string_to_entry(buffer, nfields, *ht->delimiter, hashentry, len);
@@ -219,7 +225,6 @@
else nextlist = 0;
if(!(hashentry1 = mypasswd_malloc("", nfields, &len))){
release_hash_table(ht);
- ht->tablesize = 0;
return ht;
}
for (i=0; i<nfields; i++) hashentry1->field[i] = hashentry->field[i];
--
Nicolas Baradakis
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
More information about the Freeradius-Users
mailing list