Memory crash after invoking delay module in policy (4.0.x) #1805

Open
flytomoon opened this Issue Oct 25, 2016 · 0 comments

Projects

None yet

1 participant

@flytomoon
flytomoon commented Oct 25, 2016 edited

Issue type

  • Defect - Crash or memory corruption.
  • Defect - Non compliance with a standards document, or incorrect API usage.
  • Defect - Unexpected behaviour (obvious or verified by project member).
  • Feature request.

Defect/Feature description

How to reproduce issue

Memory crash after delay is invoked via policy

  1. In 'default', add namespace = radius in server{}, add recv Access-Request (in place of Authorize), add process Access-Request{} (in place of Authenticate), add recv Accounting-Request {}, add send Access-Accept {} and send Access-Reject {} (in place of post-auth).
  2. Create policy in radiusd.conf:
    policy {
    $INCLUDE policy.d/
    rest_ok_or_delay {
    rest
    if (!ok) {
    delay
    fail
    }
    }
    }
  3. Send a request. After what seems like the 5 second delay the crash occurs.

Output of [radiusd|freeradius] -fxx -l stdout showing issue occurring

Ready to process requests
(1)  <queue> - Thread 1 handling request 1, (1 handled so far)
(1)  Received Access-Request Id 122 from 23.253.111.212:51883 to 174.143.201.142:1812 via eth0 length 247
(1)    Acct-Session-Id = "352"
(1)    NAS-Identifier = "SERVER-04"
(1)    NAS-IP-Address = 23.253.111.212
(1)    Service-Type = Framed-User
(1)    Framed-Protocol = PPP
(1)    NAS-Port = 1
(1)    NAS-Port-Type = Virtual
(1)    Tunnel-Type:0 = L2TP
(1)    Tunnel-Medium-Type:0 = IPv4
(1)    Called-Station-Id = "23.253.111.212"
(1)    Tunnel-Server-Endpoint:0 = "23.253.111.212"
(1)    Calling-Station-Id = "75.82.17.140"
(1)    Tunnel-Client-Endpoint:0 = "75.82.17.140"
(1)    User-Password = "*************"
(1)    MS-Network-Access-Server-Type = Remote-Access-Server
(1)    MS-RAS-Vendor = 311
(1)    MS-RAS-Version = "MSRASV5.20"
(1)    User-Name = "****************"
(1)    Proxy-State = 0xfe800000000000004422ec9f19633c350000022e
(1)  Running 'recv Access-Request' from file /usr/local/etc/raddb/sites-enabled/default
(1)  recv Access-Request {
(1)    preprocess (ok)
(1)    if (User-Password) {
(1)      update control {
(1)          &control:REST-HTTP-Header := Content-Type: application/json
(1)          &control:REST-HTTP-Header += Accept: application/json
(1)      } # update control (noop)
(1)      map json %{rest:GET *********************} {
(1)          EXPAND %{rest:GET *********************}
(1)          Expanding URI components
(1)          Reserved connection (0)
(1)          Sending HTTP GET to "********************"
(1)          Processing response header
(1)            Status : 200 (OK)
(1)            Type   : json (application/json)
(1)            &REST-HTTP-Status-Code := 200
(1)          Released connection (0)
(1)          Need 5 more connections to reach 10 spares
(1)          Opening additional connection (5), 1 of 27 pending slots used
rlm_rest (rest) - Skipping pre-connect, connect_uri not specified
(1)             --> {*******************}
(1)      } # map json %{rest:GET ********************} (updated)
(1)    } # if (User-Password) (updated)
(1)    update control {
(1)        &control:REST-HTTP-Header := Content-Type: application/json
(1)        &control:REST-HTTP-Header += Accept: application/json
(1)    } # update control (noop)
(1)    EXPAND %{rest:PUT ************
(1)      Expanding URI components
(1)      Reserved connection (1)
(1)      Sending HTTP PUT to "*************"
(1)      Content-Length will be 94 bytes
(1)      Processing response header
(1)        Status : 204 (No Content)
(1)        &REST-HTTP-Status-Code := 204
(1)      Released connection (1)
(1)    --> 
(1)    if (&REST-HTTP-Status-Code == 204) {
(1)      group {
(1)        rest_ok_or_delay {
(1)          rest (noop)
(1)          if (!ok) {
(1)            delay - Delaying request by ~5.000000s
(1)            delay (yield)
Thread 1 waiting to be assigned a request
(1)            Thread 1 handling request 1, (2 handled so far)
(1)  delay (ok)
(1)  fail (fail)
(1)                                                                                                                          } # if (!ok) (fail)
(1)                                                                                                                          } # rest_ok_or_delay (fail)
(1)                                                                                                                          rest_ok_or_delay {
(1)                                                                                                                          rest (noop)
(1)                                                                                                                          if (!ok) {
(1)  delay - Delaying request by ~5.000000s
Bad talloc magic value - unknown value

talloc abort: Bad talloc magic value - unknown value
CAUGHT SIGNAL: Aborted

Full backtrace from LLDB or GDB

Backtrace of last 17 frames:
/usr/local/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7f6affda11d5]
/usr/local/lib/libfreeradius-radius.so(+0xe50e)[0x7f6affda150e]
/usr/local/lib/libtalloc.so.2(+0x285c)[0x7f6aff32a85c]
/usr/local/lib/libtalloc.so.2(+0x2899)[0x7f6aff32a899]
/usr/local/lib/libtalloc.so.2(+0x293f)[0x7f6aff32a93f]
/usr/local/lib/libtalloc.so.2(_talloc_set_destructor+0x1c)[0x7f6aff32b118]
radiusd(unlang_event_timeout_add+0x148)[0x419d7d]
/usr/local/lib/rlm_delay.so(+0x11c3)[0x7f6afa52b1c3]
/usr/local/lib/rlm_delay.so(+0x1200)[0x7f6afa52b200]
radiusd[0x4186ac]
radiusd[0x419105]
radiusd(unlang_interpret_continue+0x26)[0x4199a3]
/usr/local/lib/proto_radius_auth.so(+0x2ae1)[0x7f6afbf6cae1]
radiusd[0x441ca6]
radiusd[0x44216f]
/lib64/libpthread.so.0(+0x7dc5)[0x7f6afe466dc5]
/lib64/libc.so.6(clone+0x6d)[0x7f6afdf5cced]
No panic action set
Aborted
@flytomoon flytomoon changed the title from Memory crash after invoking delay module in policy to Memory crash after invoking delay module in policy (4.0.x) Oct 26, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment