amd64/145091: getfacl segfault on ZFS / NFSv4 acl enumeration

[Dan van Pelt]

>Number:         145091
>Category:       amd64
>Synopsis:       getfacl segfault on ZFS / NFSv4 acl enumeration
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-amd64
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Mar 27 22:20:08 UTC 2010
>Closed-Date:
>Last-Modified:
>Originator:     Dan van Pelt
>Release:        8 STABLE
>Organization:
>Environment:
FreeBSD f80-2.chem.wwu.edu 8.0-STABLE FreeBSD 8.0-STABLE #0: Sat Mar 27 10:38:33 PDT 2010     dan at f80-2.chem.wwu.edu:/usr/obj/usr/src/sys/GENERIC  amd64
>Description:

This machine is running samba 3.4 / winbind and is joined to an active directory domain as a member server to act as a file server.  The volume being served is a ZFS volume where we wish to use nfs4 acls where the subjects are domain objects (groups, etc).  If a nfs4 acl is applied to a directory on the zfs volume that contains a group in AD, attempts to enumerate the acl with getfacl fail with a segfault.

>How-To-Repeat:
f80-2# mount
/dev/ad4s1a on / (ufs, local)
devfs on /dev (devfs, local, multilabel)
/dev/ad4s1d on /tmp (ufs, local, soft-updates)
/dev/ad4s1f on /usr (ufs, local, soft-updates)
/dev/ad4s1e on /var (ufs, local, soft-updates)
data on /data (zfs, local)
f80-2# getfacl /data/dan
# file: /data/dan
# owner: root
# group: wheel
            owner@:--------------:------:deny
            owner@:rwxp---A-W-Co-:------:allow
            group@:-w-p----------:------:deny
            group@:r-x-----------:------:allow
         everyone@:-w-p---A-W-Co-:------:deny
         everyone@:r-x---a-R-c--s:------:allow
f80-2# setfacl -m group:grp.my.ad.group:rwx:allow /data/dan
f80-2# getfacl /data/dan
# file: /data/dan
# owner: root
# group: wheel
Segmentation fault (core dumped)
f80-2# gdb /bin/getfacl
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...
(gdb) run /data/dan
Starting program: /bin/getfacl /data/dan
# file: /data/dan
# owner: root
# group: wheel

Program received signal SIGSEGV, Segmentation fault.
memset () at /usr/src/lib/libc/amd64/string/memset.S:56
56      L1:     rep
Current language:  auto; currently asm
(gdb) bt
#0  memset () at /usr/src/lib/libc/amd64/string/memset.S:56
#1  0x00000008006b00f4 in _nfs4_acl_to_text_np (aclp=0x800a3a000, len_p=0x0,
    flags=Variable "flags" is not available.
) at /usr/src/lib/libc/posix1e/acl_to_text_nfs4.c:193
#2  0x0000000800682b25 in acl_to_text_np (acl=0x800a3a000, len_p=0x0, flags=0)
    at /usr/src/lib/libc/posix1e/acl_to_text.c:250
#3  0x000000000040107a in print_acl (path=0x7fffffffedbd "/data/dan", type=4,
    hflag=Variable "hflag" is not available.
) at /usr/src/bin/getfacl/getfacl.c:248
#4  0x0000000000401885 in main (argc=1, argv=Variable "argv" is not available.
)
    at /usr/src/bin/getfacl/getfacl.c:334
(gdb) quit
The program is running.  Exit anyway? (y or n) y
f80-2#
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: