From 8a2269b1e768a3847e79c9178fe8d21aad599d98 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Mon, 6 Dec 2010 12:45:21 -0800 Subject: [PATCH] s3: Fix bug 7844: Race in winbind If a child dies, the parent process right away closes the socket. This is wrong, with tevent we still have events pending. This works fine for epoll but does not for at least the FreeBSD select variant. Tevent sticks a closed socket into the select masks. This then returns an error EBADF. When this happens, the parent winbind dies instead of forking a new child. This moves the socket close from the SIGCHLD cleanup function to the socket receiver. I could not reproduce the parent death anymore and it did not create an obvious fd leak. --- source3/winbindd/winbindd_dual.c | 12 ++++++++---- 1 files changed, 8 insertions(+), 4 deletions(-) diff --git a/source3/winbindd/winbindd_dual.c b/source3/winbindd/winbindd_dual.c index cc9d6de..cdf53d0 100644 --- a/source3/winbindd/winbindd_dual.c +++ b/source3/winbindd/winbindd_dual.c @@ -138,7 +138,7 @@ static void wb_child_request_trigger(struct tevent_req *req, req, struct wb_child_request_state); struct tevent_req *subreq; - if ((state->child->pid == 0) && (!fork_domain_child(state->child))) { + if ((state->child->sock == -1) && (!fork_domain_child(state->child))) { tevent_req_error(req, errno); return; } @@ -168,6 +168,12 @@ static void wb_child_request_done(struct tevent_req *subreq) ret = wb_simple_trans_recv(subreq, state, &state->response, &err); TALLOC_FREE(subreq); if (ret == -1) { + /* + * The basic parent/child communication broke, close + * our socket + */ + close(state->child->sock); + state->child->sock = -1; tevent_req_error(req, err); return; } @@ -437,6 +443,7 @@ void setup_child(struct winbindd_domain *domain, struct winbindd_child *child, "logname == NULL"); } + child->sock = -1; child->domain = domain; child->table = table; child->queue = tevent_queue_create(NULL, "winbind_child"); @@ -465,9 +472,6 @@ void winbind_child_died(pid_t pid) /* This will be re-added in fork_domain_child() */ DLIST_REMOVE(winbindd_children, child); - - close(child->sock); - child->sock = -1; child->pid = 0; } -- 1.7.3.1