AutoFS crashing due to libkrb5 bug?

[Leonardo Chiquitto]

Hello list,

I'm investigating an AutoFS bug reported in the openSUSE Bugzilla
(https://bugzilla.novell.com/show_bug.cgi?id=608295), and I'd
appreciate your help to confirm if the root cause of this problem
is in Kerberos.

As you can see in the report above, the Automounter crashes on
startup when using a combination of LDAP, SSL, GSSAPI and KRB5.
Here's the crash signature:

  automount[16881]: segfault at 7f292d642768 ip 00007f292e4ad47d sp
  00007fff673251c0 error 4 in libcom_err.so.2.1[7f292e4ac000+2000]

Enabling runtime debug info on AutoFS and libcom_err, the following
logs are printed:

n72:/ # automount -d -f
Starting automounter version 5.0.3, master map auto.master
using kernel protocol version 5.00
lookup_nss_read_master: reading master ldap auto.master
parse_server_string: lookup(ldap): Attempting to parse LDAP information from string "auto.master".
parse_server_string: lookup(ldap): mapname auto.master
parse_ldap_config: lookup(ldap): ldap authentication configured with the following options:
parse_ldap_config: lookup(ldap): use_tls: 1, tls_required: 0, auth_required: 2, sasl_mech: GSSAPI
parse_ldap_config: lookup(ldap): user: (null), secret: unspecified, client principal: host/n72.l.ngdn.org at L.NGDN.ORG credential cache: (null)
sasl_do_kinit: initializing kerberos ticket: client principal host/n72.l.ngdn.org at L.NGDN.ORG
add_error_table: krb5 (0x0x7fa646ce6560)
add_error_table: kv5m (0x0x7fa646ce6d80)
add_error_table: kdb5 (0x0x7fa646ce63e0)
add_error_table: asn1 (0x0x7fa646ce6340)
add_error_table: k524 (0x0x7fa646ce6fa0)
add_error_table: prof (0x0x7fa646cea160)
sasl_do_kinit: calling krb5_parse_name on client principal host/n72.l.ngdn.org at L.NGDN.ORG
sasl_do_kinit: Using tgs name krbtgt/L.NGDN.ORG at L.NGDN.ORG
sasl_do_kinit: Kerberos authentication was successful!
sasl_bind_mech: Attempting sasl bind with mechanism GSSAPI
getuser_func: called with context (nil), id 16385.
add_error_table: ggss (0x0x7fa6449fe760)
add_error_table: ggss (0x0x7fa6449fe760)
getuser_func: called with context (nil), id 16385.
sasl_bind_mech: sasl bind with mechanism GSSAPI succeeded
do_bind: lookup(ldap): auth_required: 2, sasl_mech GSSAPI
sasl_bind_mech: Attempting sasl bind with mechanism GSSAPI
getuser_func: called with context (nil), id 16385.
getuser_func: called with context (nil), id 16385.
sasl_bind_mech: sasl bind with mechanism GSSAPI succeeded
do_bind: lookup(ldap): autofs_sasl_bind returned 0
get_query_dn: lookup(ldap): found query dn nisMapName=auto.master,ou=autofs,ou=l,dc=ngdn,dc=org
parse_init: parse(sun): init gathered global options: (null)
do_bind: lookup(ldap): auth_required: 2, sasl_mech GSSAPI
sasl_bind_mech: Attempting sasl bind with mechanism GSSAPI
getuser_func: called with context (nil), id 16385.
getuser_func: called with context (nil), id 16385.
sasl_bind_mech: sasl bind with mechanism GSSAPI succeeded
do_bind: lookup(ldap): autofs_sasl_bind returned 0
lookup_read_master: lookup(ldap): searching for "(objectclass=nisObject)" under "nisMapName=auto.master,ou=autofs,ou=l,dc=ngdn,dc=org"
lookup_read_master: lookup(ldap): examining entries
remove_error_table FAILED: k5g (0x0x7fa6449fe9a0)
remove_error_table: ggss (0x0x7fa6449fe760)
Segmentation fault (core dumped)


It seems that we're adding the error table "ggss" twice:

  getuser_func: called with context (nil), id 16385.
  add_error_table: ggss (0x0x7fa6449fe760)
  add_error_table: ggss (0x0x7fa6449fe760)
  getuser_func: called with context (nil), id 16385.

And later trying to remove a non-existent table ("k5g"):

  remove_error_table FAILED: k5g (0x0x7fa6449fe9a0)
  remove_error_table: ggss (0x0x7fa6449fe760)
  Segmentation fault (core dumped)


Reading the Kerberos sources, I see that it's adding the "ggss" error
table in gss_krb5int_lib_init() but removing the "k5g" error table
in gss_krb5int_lib_fini(). I tested the following patch here and it
resolved the Automount problem for me but, as I'm not sure if the patch
is correct, I'm here looking for your advice.

Index: krb5-1.8.2/src/lib/gssapi/krb5/gssapi_krb5.c
===================================================================
--- krb5-1.8.2.orig/src/lib/gssapi/krb5/gssapi_krb5.c
+++ krb5-1.8.2/src/lib/gssapi/krb5/gssapi_krb5.c
@@ -740,7 +740,7 @@ int gss_krb5int_lib_init(void)
     printf("gss_krb5int_lib_init\n");
 #endif
 
-    add_error_table(&et_ggss_error_table);
+    add_error_table(&et_k5g_error_table);
 
 #ifndef LEAN_CLIENT
     err = k5_mutex_finish_init(&gssint_krb5_keytab_lock);


Thanks,
Leonardo