Attachment 4197 Details for Bug 6373 – patch for a race condition

[patch] patch for a race condition

0001-Fix-a-race-condition-in-winbind-leading-to-a-panic.patch (text/plain), 1.74 KB, created by Volker Lendecke on 2009-05-24 12:38:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Volker Lendecke

Created: 2009-05-24 12:38:28 UTC

Size: 1.74 KB

patch

obsolete

>From a0728cef7fb28543e7611f0aea364a99b4fcdf59 Mon Sep 17 00:00:00 2001
>From: Volker Lendecke <vl@samba.org>
>Date: Sun, 24 May 2009 18:57:13 +0200
>Subject: [PATCH] Fix a race condition in winbind leading to a panic
>
>In winbind, we do multiple events in one select round. This needs fixing, but
>as long as we're still using it, for efficiency reasons we need to do that.
>
>What can happen is the following: We have outgoing data pending for a client,
>thus
>
>	state->fd_event.flags == EVENT_FD_WRITE
>
>Now a new client comes in, we go through the list of clients to find an idle
>one. The detection for idle clients in remove_idle_client does not take the
>pending data into account. We close the socket that has pending outgoing data,
>the accept(2) one syscall later gives us the same socket.
>
>In new_connection(), we do a setup_async_read, setting up a read fde. The
>select from before however had found the socket (that we had already closed!!)
>to be writable. In rw_callback we only want to see a readable flag, and we
>panic in the SMB_ASSERT(flags == EVENT_FD_READ).
>
>Found using
>
>bin/smbtorture //127.0.0.1/tmp -U% -N 500 -o 2 local-wbclient
>
>Volker
>---
> source/winbindd/winbindd.c |    1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
>
>diff --git a/source/winbindd/winbindd.c b/source/winbindd/winbindd.c
>index 683e554..929a4ea 100644
>--- a/source/winbindd/winbindd.c
>+++ b/source/winbindd/winbindd.c
>@@ -798,6 +798,7 @@ static bool remove_idle_client(void)
> 
> 	for (state = winbindd_client_list(); state; state = state->next) {
> 		if (state->response.result != WINBINDD_PENDING &&
>+		    state->fd_event.flags == EVENT_FD_READ &&
> 		    !state->getpwent_state && !state->getgrent_state) {
> 			nidle++;
> 			if (!last_access || state->last_access < last_access) {
>-- 
>1.5.5
>

Actions: View

Attachments on bug 6373: 4169 | 4197