Attachment 6120 Details for Bug 7844 – Fix for master and v3-6-test.

[patch] Fix for master and v3-6-test.

0001-s3-Fix-bug-7844-Race-in-winbind.patch (text/plain), 2.21 KB, created by Jeremy Allison on 2010-12-06 14:51:13 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jeremy Allison

Created: 2010-12-06 14:51:13 UTC

Size: 2.21 KB

patch

obsolete

>From 8a2269b1e768a3847e79c9178fe8d21aad599d98 Mon Sep 17 00:00:00 2001
>From: Volker Lendecke <vl@samba.org>
>Date: Mon, 6 Dec 2010 12:45:21 -0800
>Subject: [PATCH] s3: Fix bug 7844: Race in winbind
>
>If a child dies, the parent process right away closes the socket.
>This is wrong, with tevent we still have events pending. This works
>fine for epoll but does not for at least the FreeBSD select variant.
>Tevent sticks a closed socket into the select masks. This then
>returns an error EBADF. When this happens, the parent winbind dies
>instead of forking a new child.
>
>This moves the socket close from the SIGCHLD cleanup function to
>the socket receiver. I could not reproduce the parent death anymore
>and it did not create an obvious fd leak.
>---
> source3/winbindd/winbindd_dual.c |   12 ++++++++----
> 1 files changed, 8 insertions(+), 4 deletions(-)
>
>diff --git a/source3/winbindd/winbindd_dual.c b/source3/winbindd/winbindd_dual.c
>index cc9d6de..cdf53d0 100644
>--- a/source3/winbindd/winbindd_dual.c
>+++ b/source3/winbindd/winbindd_dual.c
>@@ -138,7 +138,7 @@ static void wb_child_request_trigger(struct tevent_req *req,
> 		req, struct wb_child_request_state);
> 	struct tevent_req *subreq;
> 
>-	if ((state->child->pid == 0) && (!fork_domain_child(state->child))) {
>+	if ((state->child->sock == -1) && (!fork_domain_child(state->child))) {
> 		tevent_req_error(req, errno);
> 		return;
> 	}
>@@ -168,6 +168,12 @@ static void wb_child_request_done(struct tevent_req *subreq)
> 	ret = wb_simple_trans_recv(subreq, state, &state->response, &err);
> 	TALLOC_FREE(subreq);
> 	if (ret == -1) {
>+		/*
>+		 * The basic parent/child communication broke, close
>+		 * our socket
>+		 */
>+		close(state->child->sock);
>+		state->child->sock = -1;
> 		tevent_req_error(req, err);
> 		return;
> 	}
>@@ -437,6 +443,7 @@ void setup_child(struct winbindd_domain *domain, struct winbindd_child *child,
> 			  "logname == NULL");
> 	}
> 
>+	child->sock = -1;
> 	child->domain = domain;
> 	child->table = table;
> 	child->queue = tevent_queue_create(NULL, "winbind_child");
>@@ -465,9 +472,6 @@ void winbind_child_died(pid_t pid)
> 	/* This will be re-added in fork_domain_child() */
> 
> 	DLIST_REMOVE(winbindd_children, child);
>-
>-	close(child->sock);
>-	child->sock = -1;
> 	child->pid = 0;
> }
> 
>-- 
>1.7.3.1
>

Actions: View

Attachments on bug 7844: 6119 | 6120