NetBSD Problem Report #60481

From www@netbsd.org  Thu Jul 23 02:01:36 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 4D5CA1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 23 Jul 2026 02:01:36 +0000 (UTC)
Message-Id: <20260723020135.1FDC91A923C@mollari.NetBSD.org>
Date: Thu, 23 Jul 2026 02:01:35 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: kpasswdd(8): free of stack buffer on exit
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60481
>Category:       bin
>Synopsis:       kpasswdd(8): free of stack buffer on exit
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 23 02:05:00 +0000 2026
>Last-Modified:  Wed Sep 02 16:40:02 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ....
>Organization:
The kNetBSD Heimdallation, Incore dumped
>Environment:
>Description:
	Found a kpasswdd.core lying around on a KDC host from a while
	back.

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000070131a70f647 in free () from /usr/lib/libc.so.12
(gdb) bt
#0  0x000070131a70f647 in free () from /usr/lib/libc.so.12
#1  0x00000001bf40417a in doit ()
#2  0x00000001bf404b9b in main ()
(gdb) fr 1
#1  0x00000001bf40417a in doit ()
(gdb) disas
...
   0x00000001bf40414b <+3279>:  xor    %ebx,%ebx
   0x00000001bf40414d <+3281>:  mov    -0x6e0(%rbp),%r12d
   0x00000001bf404154 <+3288>:  mov    -0x6f8(%rbp),%r13
   0x00000001bf40415b <+3295>:  mov    0x0(%r13,%rbx,4),%edi
   0x00000001bf404160 <+3300>:  call   0x1bf402b40 <close@plt>
   0x00000001bf404165 <+3305>:  add    $0x1,%rbx
   0x00000001bf404169 <+3309>:  cmp    %ebx,%r12d
   0x00000001bf40416c <+3312>:  ja     0x1bf40415b <doit+3295>
   0x00000001bf40416e <+3314>:  mov    -0x6f8(%rbp),%rdi
   0x00000001bf404175 <+3321>:  call   0x1bf4026b0 <free@plt>
=> 0x00000001bf40417a <+3326>:  mov    -0x6bc(%rbp),%edx

	Looks like that's here:

    855     for (i = 0; i < n; ++i)
    856 	close(sockets[i]);
 => 857     free(sockets);

https://nxr.netbsd.org/xref/src/crypto/external/bsd/heimdal/dist/kpasswd/kpasswdd.c?r=1.5#855

	What's sockets?  Well, since kpasswdd(8) is running under
	inetd(8), it probably came out of this:

    729 #ifdef INETD_SUPPORT
    730     int fdz;
    731     int from_inetd;
    732     socklen_t fromlen;
    733     krb5_address my_addr;
    734     struct sockaddr_storage __local;
    735     struct sockaddr *localsa = (struct sockaddr *)&__local;
    736 #endif
...
    782 #ifdef INETD_SUPPORT
    783     } else {
    784         n = 1;
    785         maxfd = 0;
    786 	fdz = 0;
 => 787         sockets = &fdz;
    788         FD_ZERO(&real_fdset);
    789         FD_SET(0, &real_fdset);
    790     }
    791 #endif

	That's not something you can pass to free(3)!

>How-To-Repeat:

	1. run kpasswdd(8) under inetd(8) like we suggest with the
	   default inetd.conf
	2. use kpasswd(1) to make sure it has started
	3. send kpasswdd(8) SIGTERM
	4. (send it SIGTERM again if you caught it in the signal race
	   window that I notice by code inspection)

>Fix:

#ifdef INETD_SUPPORT
	if (!from_inetd)
#endif

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60481 CVS commit: src/crypto/external/bsd/heimdal/dist/kpasswd
Date: Wed, 2 Sep 2026 16:35:09 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Wed Sep  2 16:35:09 UTC 2026

 Modified Files:
 	src/crypto/external/bsd/heimdal/dist/kpasswd: kpasswdd.c

 Log Message:
 kpasswdd(8): Avoid freeing stack buffer on exit in inetd mode.

 PR bin/60481: kpasswdd(8): free of stack buffer on exit


 To generate a diff of this commit:
 cvs rdiff -u -r1.5 -r1.6 \
     src/crypto/external/bsd/heimdal/dist/kpasswd/kpasswdd.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

Home	PR Database Search