Running make TESTS="samba4.rpc.lsa" test in a loop will trigger the crash.

It appears to be a race condition between.
source3/windbindd/winbindd_util.c terminate_child which
   kills the child process, and frees the child monitor_fde.

		kill(c->pid, SIGTERM);
		c->pid = 0;
		if (c->sock != -1) {
		close(c->sock);
		// }
		// c->sock = -1;
		// DBG_ERR("Freed c->monitor_fde (%p), pid (%d)\n",
		// 	c->monitor_fde, c->pid);
		// TALLOC_FREE(c->monitor_fde);



and

lib/tevent/tevent_epoll.c epoll_event_loop line 632
               struct tevent_fd *fde = talloc_get_type(events[i].data.ptr,
						       struct tevent_fd);

The kill makes the child socked readable as the child process has gone away.







The TALLOC_FREE(c->monitor_fde);

Sigh, lets try that againn :-)

Running make TESTS="samba4.rpc.lsa" test in a loop will trigger the crash.

It appears to be a race condition between.
source3/windbindd/winbindd_util.c terminate_child which
   kills the child process,
   and frees the child monitor_fde.

		kill(c->pid, SIGTERM);
		c->pid = 0;
		if (c->sock != -1) {
		        close(c->sock);
		}
		c->sock = -1;
		TALLOC_FREE(c->monitor_fde);



and

lib/tevent/tevent_epoll.c epoll_event_loop line 632
               struct tevent_fd *fde = talloc_get_type(events[i].data.ptr,
						       struct tevent_fd);

The kill makes the child socked readable as the child process has gone away, which has:

source3/windbindd/winbindd_dual.c child_socket_readable registered

events[i].data.ptr points to c->monitor_fde

Except this code is all synchronous, and the talloc destructor removes the FD from the epoll list.

But the the epoll_wait is returning an event that points to freed memory.
Need to find out where that's coming from.

https://gitlab.com/samba-team/samba/-/merge_requests/4283 also has some details...

Gary, what OS and kernel is this on?

6.14.0-35-generic #35~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Oct 14 13:55:17 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

But I did see a failure in CI, which is what started me down the rabbit hole.

I see pretty often samba-ad-dc-4b failing with WBC_ERR_WINBIND_NOT_AVAILABLE:

https://gitlab.com/samba-team/devel/samba/-/jobs/12368740677

(In reply to Andreas Schneider from comment #9)
In case this bug lasts longer than the CI log, here are some relevant lines

> Pulling docker image registry.gitlab.com/samba-team/devel/samba/samba-ci-ubuntu2204:336927a79f09b3eb729c64872bf4eca3e2f6761f
> Linux runner-xs6vzpvoq-project-6378020-concurrent-0 5.15.154+ #1 SMP Sat May 4 12:14:42 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

> ==> /builds/samba-team/devel/samba/samba-ad-dc-4b.stdout <==
> [149(913)/192 at 3m41s] samba4.blackbox.kinit_trust(fl2008r2dc:local)
> 
> ==> /builds/samba-team/devel/samba/samba-ad-dc-4b.stderr <==
> 2025-12-09T09:53:01.701228+00:00 dc7.samba2008r2.example.com samba[574]: winbindd daemon died with exit status 6
> 2025-12-09T09:53:01.701276+00:00 dc7.samba2008r2.example.com samba[574]: task_server_terminate: task_server_terminate: [winbindd child process exited]
> 2025-12-09T09:53:01.702712+00:00 dc7.samba2008r2.example.com samba[559]: samba_terminate: samba_terminate of samba 559: winbindd child process exited
> 
> ==> /builds/samba-team/devel/samba/samba-ad-dc-4b.stdout <==
> UNEXPECTED(failure): samba4.blackbox.kinit_trust.wbinfo check outgoing trust pw(fl2008r2dc:local)
> REASON: Exception: Exception: failed to call wbcCheckTrustCredentials: WBC_ERR_WINBIND_NOT_AVAILABLE

Created attachment 18792 [details]
Proposed fix (version 1)

It looks to be a race condition between the child socket closing, and it being de-registered from epoll.

Created attachment 18796 [details]
Proposed fix (version 2)

Updated the commit title

(In reply to Gary Lockyer from comment #13)

Looks good, but why did you close the merge request and didn't push
the updated patch there?

(In reply to Stefan Metzmacher from comment #14)

Ok, looked at the wrong MR

This bug was referenced in samba master:

a3684a2284cdf421090d6064b720b81b05b6eae6

Created attachment 18798 [details]
patch for 4.23

Backport to 4.23 is trivial; beyond that looks tricky.

For 4.23.

This bug was referenced in samba v4-23-test:

36f0300cda5989c948801fba0f8b0b64066f54a9

This bug was referenced in samba v4-23-stable (Release samba-4.23.5):

36f0300cda5989c948801fba0f8b0b64066f54a9