[Bug 2457467] New: sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

Bug ID: 2457467
           Summary: sssd-kcm fails to start if krb5_renew_interval is
                    specified
           Product: Fedora
           Version: 44
          Hardware: x86_64
                OS: Linux
            Status: NEW
         Component: sssd
          Severity: high
          Assignee: [e-mail]
          Reporter: [e-mail]
        QA Contact: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail]
  Target Milestone: ---
    Classification: Fedora

Description of problem:

Configuration like this in /etc/sssd/sssd.conf:
---
[kcm]
tgt_renewal = true
krb5_renewable_lifetime = 7d
krb5_renew_interval = 5m
---

Causes memory allocation failures, like this:
---
(2026-04-10 22:13:51): [kcm] [kcm_get_renewal_config] (0x0040): Failed setting
krb5 options for renewal [12]: Cannot allocate memory
(2026-04-10 22:13:51): [kcm] [kcm_renewals_init] (0x0010): Unable to read TGT
renewal configuration [12]: Cannot allocate memory
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING
BACKTRACE:
   *  (2026-04-10 22:13:51): [kcm] [kcm_get_renewal_config] (0x0040): Failed
setting krb5 options for renewal [12]: Cannot allocate memory
   *  (2026-04-10 22:13:51): [kcm] [kcm_renewals_init] (0x0010): Unable to read
TGT renewal configuration [12]: Cannot allocate memory
********************** BACKTRACE DUMP ENDS HERE
*********************************
---

Interestingly, adding debug_level of 3 or 10 (I have not tried any other
values), makes sssd-kcm start:
---
[kcm]
debug_level = 3
tgt_renewal = true
krb5_renewable_lifetime = 7d
krb5_renew_interval = 5m
---

Also, removing krb5_renew_interval from this section makes sssd-kcm work again.
Putting that line in another appropriate section of sssd.conf works, but the
setting will not be applied to sssd-kcm, making renewal interval not apply.

Version-Release number of selected component (if applicable):
sssd-kcm-2.12.0-4.fc44.x86_64

How reproducible:
Always.

Steps to Reproduce:
1. Inherit this configuration from Fedora 43, upgrade to Fedora 44.
2. Observe sssd-kcm service fails to start.
3. Add debug_level and see it run again.

Actual results:
Weirdly, adding debug_level at certain values changes the behaviour of this
daemon.

Expected results:
Used to run on Fedora 43.

Additional info:
Maybe compiling with gcc 15.2.1 somehow masks a real bug that surfaces with gcc
16.0.1?

[Bug 2457467] sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

--- Comment #1 from Lukas Slebodnik  ---
(2026-04-11 11:04:12): [kcm] [ccdb_secdb_init] (0x2000): secdb initialized
(2026-04-11 11:04:12): [kcm] [kcm_get_renewal_config] (0x0400): Option
[tgt_renewal] set to [true]
(2026-04-11 11:04:12): [kcm] [kcm_get_renewal_config] (0x0400): Option
[tgt_renewal_inherit] set to [none]
(2026-04-11 11:04:12): [kcm] [kcm_set_options] (0x0010): krb5_string_to_deltat
failed
(2026-04-11 11:04:12): [kcm] [kcm_get_renewal_config] (0x0040): Failed setting
krb5 options for renewal [12]: Cannot allocate memory

Looks like use-after free based on brief code analysis

*
https://github.com/SSSD/sssd/blob/58cc4d2263adfbe64214b79aa9c5ae8b8a577fc7/s...
due to missing talloc_steal in the function kcm_read_options

[Bug 2457467] sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

--- Comment #2 from Bojan Smojver  ---
I asked Gemini to analyse and it came up with this:

--- a/src/responder/kcm/kcm_renew.c
+++ b/src/responder/kcm/kcm_renew.c
@@ -211,7 +211,7 @@ kcm_read_options(struct kcm_renew_ctx *rectx,
         goto done;
     }

-    rectx->opts = opts;
+    rectx->opts = talloc_steal(rectx, opts);
     ret = EOK;

done:

I also asked Gemini to analyse this file more generally and this is what it
came up with:

--- a/src/responder/kcm/kcm_renew.c
+++ b/src/responder/kcm/kcm_renew.c
@@ -165,6 +165,15 @@ struct kcm_renew_ctx {
     struct kcm_options *opts;
 };

+static int kcm_renew_ctx_destructor(struct kcm_renew_ctx *rectx)
+{
+    if (rectx->dom_ctx && rectx->dom_ctx->renew_ctx == rectx) {
+        rectx->dom_ctx->renew_ctx = NULL;
+    }
+    return 0;
+}
+
 static errno_t kcm_read_options(struct kcm_renew_ctx *rectx,
                                 struct confdb_ctx *cdb,
                                 const char *conf_path)
@@ -211,7 +220,7 @@ static errno_t kcm_read_options(struct kcm_renew_ctx
*rectx,
         goto done;
     }

-    rectx->opts = opts;
+    rectx->opts = talloc_steal(rectx, opts);
     ret = EOK;

done:
@@ -285,6 +294,8 @@ errno_t kcm_renew_init(struct kcm_dom_ctx *dom_ctx)
         return ENOMEM;
     }

+    talloc_set_destructor(rectx, kcm_renew_ctx_destructor);
+
     rectx->ev = dom_ctx->kcm_ctx->ev;
     rectx->dom_ctx = dom_ctx;

[Bug 2457467] sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

Alexey Tikhonov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|[e-mail] |[e-mail]
                   |raproject.org               |

[Bug 2457467] sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

Alexey Tikhonov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED

--- Comment #3 from Alexey Tikhonov  ---
(In reply to Bojan Smojver from comment #2)
> I asked Gemini to analyse and it came up with this:
>
> --- a/src/responder/kcm/kcm_renew.c
> +++ b/src/responder/kcm/kcm_renew.c
> @@ -211,7 +211,7 @@ kcm_read_options(struct kcm_renew_ctx *rectx,
>          goto done;
>      }
> rectx->opts = opts;
> rectx->opts = talloc_steal(rectx, opts);

Can't make sense of this ^^: there is no "rectx->opts = opts;" line (or `rectx`
var at all in `src/responder/kcm`)

Anyway: https://github.com/SSSD/sssd/pull/8592

[Bug 2457467] sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

--- Comment #4 from Bojan Smojver  ---
Looks like Gemini imagined some code there... 😉

[Bug 2457467] sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

--- Comment #5 from Lukas Slebodnik  ---
> Anyway: https://github.com/SSSD/sssd/pull/8592

Is identical as I mentioned in previous comment :-) And I am not called `Claude
Code (Opus 4.6)`

```
From e03b18c1bfd78130a7759d4404c963bbd65ed8af Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov 
Date: Mon, 13 Apr 2026 09:21:45 +0200
Subject: [PATCH] KCM: fix use-after-free in `kcm_read_options()`

The `renew_intv` string was allocated under tmp_ctx but not re-linked
to mem_ctx before tmp_ctx was freed.

Assisted-By: Claude Code (Opus 4.6)
---
 src/responder/kcm/kcm_renew.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/responder/kcm/kcm_renew.c b/src/responder/kcm/kcm_renew.c
index 39e9470fa22..32eccf4b48a 100644
--- a/src/responder/kcm/kcm_renew.c
+++ b/src/responder/kcm/kcm_renew.c
@@ -228,7 +228,7 @@ static errno_t kcm_read_options(TALLOC_CTX *mem_ctx,
     *_validate = validate;
     *_canonicalize = canonicalize;
     *_timeout = timeout;
-    *_renew_intv = renew_intv;
+    *_renew_intv = talloc_steal(mem_ctx, renew_intv);

```

Anyway, I would recommend additional changes.
The error(return code) from `krb5_string_to_deltat` is completely ignored and
not logged at all.
> (2026-04-11 11:04:12): [kcm] [kcm_set_options] (0x0010): krb5_string_to_deltat failed

*
https://github.com/SSSD/sssd/blob/58cc4d2263adfbe64214b79aa9c5ae8b8a577fc7/s...

Logging (hex)decimal value would be better than current state.

Similar as in
https://github.com/SSSD/sssd/blob/58cc4d2263adfbe64214b79aa9c5ae8b8a577fc7/s...
but the code ^^ is not ideal either.
Calling sss_strerror for returned type `krb5_error_code` is not useful.
One should call call krb5_get_error_message for krb5 return codes.

[Bug 2457467] sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

--- Comment #6 from Alexey Tikhonov  ---
(In reply to Lukas Slebodnik from comment #5)
> Anyway, I would recommend additional changes.
> The error(return code) from `krb5_string_to_deltat` is completely ignored
> and not logged at all.
> > (2026-04-11 11:04:12): [kcm] [kcm_set_options] (0x0010): krb5_string_to_deltat failed
>
> https://github.com/SSSD/sssd/blob/58cc4d2263adfbe64214b79aa9c5ae8b8a577fc7/
> src/responder/kcm/kcm_renew.c#L74
>
> Logging (hex)decimal value would be better than current state.
>
> Similar as in
> https://github.com/SSSD/sssd/blob/58cc4d2263adfbe64214b79aa9c5ae8b8a577fc7/
> src/responder/kcm/kcm_renew.c#L88-L106
> but the code ^^ is not ideal either.
> Calling sss_strerror for returned type `krb5_error_code` is not useful.
> One should call call krb5_get_error_message for krb5 return codes.

Please, feel free to open a PR.

[Bug 2457467] sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

Alexey Tikhonov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |POST

--- Comment #7 from Alexey Tikhonov  ---
https://github.com/SSSD/sssd/commit/0100b1c3536688c12f1db2a65164f03765727f81

[Bug 2457467] sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

--- Comment #8 from Lukas Slebodnik  ---
(In reply to Alexey Tikhonov from comment #6)
> (In reply to Lukas Slebodnik from comment #5)
> > Anyway, I would recommend additional changes.
> > The error(return code) from `krb5_string_to_deltat` is completely ignored
> > and not logged at all.
> > > (2026-04-11 11:04:12): [kcm] [kcm_set_options] (0x0010): krb5_string_to_deltat failed
> >
> > https://github.com/SSSD/sssd/blob/58cc4d2263adfbe64214b79aa9c5ae8b8a577fc7/
> > src/responder/kcm/kcm_renew.c#L74
> >
> > Logging (hex)decimal value would be better than current state.
> >
> > Similar as in
> > https://github.com/SSSD/sssd/blob/58cc4d2263adfbe64214b79aa9c5ae8b8a577fc7/
> > src/responder/kcm/kcm_renew.c#L88-L106
> > but the code ^^ is not ideal either.
> > Calling sss_strerror for returned type `krb5_error_code` is not useful.
> > One should call call krb5_get_error_message for krb5 return codes.
>
> Please, feel free to open a PR.

I would be glad if repo is hosted in more open Git hosting service (e.g.
gitlab.com)
And IMHO maintainer of repo should care about quality of reporting in debug
messages regardless of where the issue was reported.
If you are fine with current sub-optimal state; feel free to keep it. And I
would like to apologize i bother you with such comments.
> https://github.com/SSSD/sssd/commit/0100b1c3536688c12f1db2a65164f03765727f81

TYVM for fixing issue in upstream
would you mind to share when one can expect fixed build in fedora?

[Bug 2457467] sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

--- Comment #9 from Alexey Tikhonov  ---
(In reply to Lukas Slebodnik from comment #8)
> > https://github.com/SSSD/sssd/commit/0100b1c3536688c12f1db2a65164f03765727f81
>
> TYVM for fixing issue in upstream
> would you mind to share when one can expect fixed build in fedora?

This plan an upstream release and Fedora rebases, hopefully, this week.
If not I'll rebuild Fedora cherry-picking a patch.

[Bug 2457467] sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

--- Comment #10 from Lukas Slebodnik  ---
(In reply to Alexey Tikhonov from comment #9)
> (In reply to Lukas Slebodnik from comment #8)
> > > https://github.com/SSSD/sssd/commit/0100b1c3536688c12f1db2a65164f03765727f81
> >
> > TYVM for fixing issue in upstream
> > would you mind to share when one can expect fixed build in fedora?
>
> This plan an upstream release and Fedora rebases, hopefully, this week.
> If not I'll rebuild Fedora cherry-picking a patch.

Fedora 44 should be GA tomorrow based on current schedule
* https://fedorapeople.org/groups/schedule/f-44/f-44-all-tasks.html -> Index
158

It will take some time till the bodhi update get from updates-testing to ->
updates.
I hope a new update will be available soon for f44; cause more people can hit
the bug after GA.
And it is possible it could consider to be a CVE too.
Fortunately, it is not a default setting in Fedora.

[Bug 2457467] sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

--- Comment #11 from Bojan Smojver  ---
Any chance of getting an update into testing of F44? I'm happy to verify that
it resolves the problem.

[Bug 2457467] sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

Alexey Tikhonov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|POST                        |ON_QA

--- Comment #12 from Alexey Tikhonov  ---
https://src.fedoraproject.org/rpms/sssd/pull-request/82

https://bodhi.fedoraproject.org/updates/FEDORA-2026-5a171eddb6

[Bug 2457467] sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

Alexey Tikhonov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Fixed In Version|                            |sssd-2.13.0-1.fc44

[Bug 2457467] sssd-kcm fails to start if krb5_renew_interval is specified

https://bugzilla.redhat.com/show_bug.cgi?id=2457467

--- Comment #13 from Bojan Smojver  ---
Thank you!