afpd crashes in dircache with tainted dir

[rdmark]

When sharing a volume that has a subdir containing another netatalk shared volume, you get a crash in the dircache_add() function when you try to connect to a shared volume. Debian 12, and afp.conf containing only [Homes] basedir regex = /home

Jul 13 21:38:54 alien afpd[229598]: afp_disconnect: primary reconnect failed
Jul 13 21:38:55 alien afpd[229598]: PANIC: ntohl(dir->d_did) >= CNID_START
Jul 13 21:38:55 alien afpd[229598]: BACKTRACE: 11 stack frames:
Jul 13 21:38:55 alien afpd[229598]:  #0 /lib/x86_64-linux-gnu/libatalk.so.18(netatalk_panic+0x26) [0x7f23658583d9]
Jul 13 21:38:55 alien afpd[229598]:  #1 /usr/sbin/afpd(dircache_add+0x75) [0x564855e6f357]
Jul 13 21:38:55 alien afpd[229598]:  #2 /usr/sbin/afpd(dir_add+0x4ac) [0x564855e720a4]
Jul 13 21:38:55 alien afpd[229598]:  #3 /usr/sbin/afpd(+0x246aa) [0x564855e776aa]
Jul 13 21:38:55 alien afpd[229598]:  #4 /usr/sbin/afpd(afp_enumerate_ext2+0x41) [0x564855e77b6c]
Jul 13 21:38:55 alien afpd[229598]:  #5 /usr/sbin/afpd(afp_over_dsi+0x966) [0x564855e6340c]
Jul 13 21:38:55 alien afpd[229598]:  #6 /usr/sbin/afpd(+0x3ebc9) [0x564855e91bc9]
Jul 13 21:38:55 alien afpd[229598]:  #7 /usr/sbin/afpd(main+0xdcc) [0x564855e9189f]
Jul 13 21:38:55 alien afpd[229598]:  #8 /lib/x86_64-linux-gnu/libc.so.6(+0x2724a) [0x7f23651ae24a]
Jul 13 21:38:55 alien afpd[229598]:  #9 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x85) [0x7f23651ae305]
Jul 13 21:38:55 alien afpd[229598]:  #10 /usr/sbin/afpd(_start+0x21) [0x564855e608f1]

[rdmark]

Some added logging shows:

Jul 14 09:12:38 alien afpd[284738]: Login by dmark (AFP3.4)
Jul 14 09:12:38 alien afpd[284738]: dircache(did:17,'.DS_Store'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:18,'share2'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:19,'Pictures'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:20,'.sbuildrc'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:65,'nfs'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:21,'.xorgxrdp.10.log'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:22,'Music'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:23,'msg'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:24,'Downloads'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:25,'.xxe10'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:26,'Videos'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:27,'Desktop'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:28,'.config'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:44,'.AppleDouble'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:29,'.reportbugrc'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:30,'.cache'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:31,'.bluefish'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:32,'.docker'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:33,'Network Trash Folder'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:34,'Public'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:35,'tmp'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:36,'.gnupg'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:37,'.cups'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:38,'.bash_logout'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:39,'share'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:91,'TheVolumeSettingsFolder'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:40,'.bashrc'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:41,'.quiltrc-dpkg'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:42,'thinclient_drives'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:43,'.tmp'): assert
Jul 14 09:12:38 alien afpd[284738]: dircache(did:2,'afpshare'): assert
Jul 14 09:12:38 alien afpd[284738]: PANIC: ntohl(dir->d_did) >= CNID_START

Turns out this is caused by the 'afpshare' subdir in my home dir on this computer, which is getting did=2 which is lower than the lowest allowed 17... The afpshare dir itself is a netatalk shared volume with its own CNID metadata. When removing it, the issue goes away.

This represents an invalid usecase, I think. But it ought to be handled more gracefully, arguably. And why does it occur only when the package is built with --prefix? Very strange.

[rdmark]

I will add some helpful error logging here to point the user to a solution.

[rdmark]

I had something like this in mind

        LOG(log_error, logtype_afpd,
            "dircache(): did:%u is less than the allowed %d. Check the contents of \"%s\".",
            ntohl(dir->d_did), cfrombstr(dir->d_u_name), CNID_START);

...but, even with the original volume data I cannot reproduce now, and won't add code I cannot test properly.