Bug 8667 - race in updating winbindd_children list
Summary: race in updating winbindd_children list
Status: RESOLVED DUPLICATE of bug 8409
Alias: None
Product: Samba 3.6
Classification: Unclassified
Component: Winbind (show other bugs)
Version: 3.6.0
Hardware: All All
: P5 major
Target Milestone: ---
Assignee: Michael Adam
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-12-16 17:23 UTC by Herb Lewis
Modified: 2011-12-16 17:57 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Herb Lewis 2011-12-16 17:23:26 UTC
I ran into a case where the idmap winbindd paniced and resulted in a corrupted
winbindd_children list. The new idmap winbindd was forked and added to the list
before the SIGCHLD handler removed the old one from the list. When the function
winbind_child_died is finally called, the list is corrupted and results in an
infinite loop.

Adding a static child structure to the list that already contains the entry for
that (previous) child will corrupt the list as follows. Consider the list that
has 5 entries (as my case did).

List points to entry 1
Entry  next ptr   prev ptr
1       2         5
2       3         1  (this is the static idmap entry)
3       4         2
4       5         3
5       NULL      4

now when you attempt to insert entry 2 again you get the following
when DLIST_ADD does
   (p)->prev = (list)->prev; \   2 prev = 5
   (list)->prev = (p); \         1 prev = 2 
   (p)->next = (list); \         2 next = 1
   (list) = (p); \               List = 2

List points to entry 2
Entry  next ptr   prev ptr
1       2         2
2       1         5  (this is the static idmap entry)
3       4         2
4       5         3
5       NULL      4

You now have an infinite next loop from 2 to 1 and back
Comment 1 Volker Lendecke 2011-12-16 17:27:19 UTC
Hi, Herb!

Is it possible that this is already fixed with b181fe9ec50ff, to be found under http://git.samba.org/?p=samba.git;a=commitdiff;h=b181fe9ec50ff ?

Volker
Comment 2 Volker Lendecke 2011-12-16 17:29:55 UTC
You might also want to take a look at

https://bugzilla.samba.org/show_bug.cgi?id=8409
Comment 3 Herb Lewis 2011-12-16 17:57:41 UTC

*** This bug has been marked as a duplicate of bug 8409 ***