Attachment 18796 Details for Bug 15937 – Proposed fix (version 2)

[patch] Proposed fix (version 2)

fix-15937-v2.patch (text/plain), 1.68 KB, created by Gary Lockyer on 2026-01-12 19:26:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Gary Lockyer

Created: 2026-01-12 19:26:36 UTC

Size: 1.68 KB

patch

obsolete

>From 25876da6ab3e6fe696e08ac96d8bc6a2109feb55 Mon Sep 17 00:00:00 2001
>From: Gary Lockyer <gary@catalyst.net.nz>
>Date: Wed, 7 Jan 2026 10:23:33 +1300
>Subject: [PATCH] s3:winbindd fix race condition in terminate_child
>
>Fixes:
>
>winbindd[306061]:   Bad talloc magic value - unknown value
>winbindd[306061]:   =========================================================
>winbindd[306061]:   INTERNAL ERROR: Bad talloc magic value - unknown value in
>                    winbindd () () pid
>
>A race condition in source3/windbindd/winbindd_util.c::terminate_child
>between the child socket closing, and the destructor de-registering the
>child socket from epoll.
>
>If the socket closes before it is de-registered from epoll, the event
>is added to the epoll rdllink and will be retrieved when epoll_wait
>is next called.  However monitor_fde has been deallocated and we get the
>observed failure.
>
>Moving the TALLOC_FREE before the kill ensures that the child socket has been
>de-registered from epoll before it closes.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=15937
>
>Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
>---
> source3/winbindd/winbindd_util.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
>index 2e86336322c..bc2ad712fdb 100644
>--- a/source3/winbindd/winbindd_util.c
>+++ b/source3/winbindd/winbindd_util.c
>@@ -978,13 +978,13 @@ static void terminate_child(struct tevent_req *subreq)
> 	TALLOC_FREE(subreq);
> 
> 	if (c->pid != 0) {
>+		TALLOC_FREE(c->monitor_fde);
> 		kill(c->pid, SIGTERM);
> 		c->pid = 0;
> 		if (c->sock != -1) {
> 			close(c->sock);
> 		}
> 		c->sock = -1;
>-		TALLOC_FREE(c->monitor_fde);
> 	}
> 
> 	c = NULL;
>-- 
>2.43.0
>

Actions: View

Attachments on bug 15937: 18763 | 18792 | 18796 | 18798