Attachment 4207 Details for Bug 6409 – Patch for 3.3

[patch] Patch for 3.3

0001-Fix-a-race-condition-in-winbind-leading-to-a-panic.patch (text/plain), 1.74 KB, created by Volker Lendecke on 2009-05-26 06:04:23 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Volker Lendecke

Created: 2009-05-26 06:04:23 UTC

Size: 1.74 KB

patch

obsolete

>From dff753363d57da8c7a1d0a068960439fef845ea8 Mon Sep 17 00:00:00 2001
>From: Volker Lendecke <vl@samba.org>
>Date: Sun, 24 May 2009 18:57:13 +0200
>Subject: [PATCH] Fix a race condition in winbind leading to a panic
>
>In winbind, we do multiple events in one select round. This needs fixing, but
>as long as we're still using it, for efficiency reasons we need to do that.
>
>What can happen is the following: We have outgoing data pending for a client,
>thus
>
>	state->fd_event.flags == EVENT_FD_WRITE
>
>Now a new client comes in, we go through the list of clients to find an idle
>one. The detection for idle clients in remove_idle_client does not take the
>pending data into account. We close the socket that has pending outgoing data,
>the accept(2) one syscall later gives us the same socket.
>
>In new_connection(), we do a setup_async_read, setting up a read fde. The
>select from before however had found the socket (that we had already closed!!)
>to be writable. In rw_callback we only want to see a readable flag, and we
>panic in the SMB_ASSERT(flags == EVENT_FD_READ).
>
>Found using
>
>bin/smbtorture //127.0.0.1/tmp -U% -N 500 -o 2 local-wbclient
>
>Volker
>---
> source/winbindd/winbindd.c |    1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
>
>diff --git a/source/winbindd/winbindd.c b/source/winbindd/winbindd.c
>index f333e37..9005e67 100644
>--- a/source/winbindd/winbindd.c
>+++ b/source/winbindd/winbindd.c
>@@ -778,6 +778,7 @@ static bool remove_idle_client(void)
> 
> 	for (state = winbindd_client_list(); state; state = state->next) {
> 		if (state->response.result != WINBINDD_PENDING &&
>+		    state->fd_event.flags == EVENT_FD_READ &&
> 		    !state->getpwent_state && !state->getgrent_state) {
> 			nidle++;
> 			if (!last_access || state->last_access < last_access) {
>-- 
>1.6.2.1
>

Actions: View

Attachments on bug 6409: 4206 | 4207