winbindd crash in winbindd_cm.c ...

[Richard Sharpe]

On Tue, Jun 13, 2017 at 4:39 PM, Richard Sharpe
<realrichardsharpe at gmail.com> wrote:
> On Tue, Jun 13, 2017 at 4:32 PM, Richard Sharpe
> <realrichardsharpe at gmail.com> wrote:
>> Has anyone seen this crash before:
>>
>> #8  cm_connect_lsa_tcp (domain=domain at entry=0x7f15e8be7cc0,
>> cli=cli at entry=0x7ffd908b53f8, mem_ctx=0x7f15e8bf10b0) at
>> ../source3/winbindd/winbindd_cm.c:2982
>>
>> Here:
>>
>> 2982            if (conn->lsa_pipe_tcp &&
>> 2983                conn->lsa_pipe_tcp->transport->transport == NCACN_IP_TCP &&
>> 2984                conn->lsa_pipe_tcp->auth->auth_level >=
>> DCERPC_AUTH_LEVEL_INTEGRITY &&
>> 2985                rpccli_is_connected(conn->lsa_pipe_tcp)) {
>> 2986                    goto done;
>>
>> conn->lsa_pipe_tcp->transport is NULL.
>>
>> I am not finding where it is set at the moment.
>
> Hmmm, that is weird. A little lower down we see where it will connect
> with cli_rpc_pipe_open_schannel_with_creds so it seems like that
> failed without letting us know.

More info: 4.5.9

Here is what he appropriate structure looks like:

(gdb) p *domain->conn->lsa_pipe_tcp
$4 = {prev = 0x0, next = 0x0, transport = 0x0, binding_handle = 0x7f15e8bf2220,
  abstract_syntax = {uuid = {time_low = 305420152, time_mid = 4660,
      time_hi_and_version = 43981, clock_seq = <incomplete sequence \357>,
      node = "\001#Eg\211\253"}, if_version = 0}, transfer_syntax = {uuid = {
      time_low = 2324192516, time_mid = 7403, time_hi_and_version = 4553,
      clock_seq = "\237", <incomplete sequence \350>, node = "\b\000+\020H`"},
    if_version = 2}, verified_pcontext = false,
  desthost = 0x7f15e8bf9e20 "win2012R21.win.ad.test",
  srv_name_slash = 0x7f15e8bf93f0 "\\\\WIN2012R21.WIN.AD.TEST",
max_xmit_frag = 4280,
  auth = 0x7f15e8c18da0}

I can't see, as yet, any way in the code that transport would be NULL.

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)