Bug 9455 - munmap called for an address location not mapped by samba
munmap called for an address location not mapped by samba
Status: RESOLVED FIXED
Product: Samba 3.5
Classification: Unclassified
Component: libsmbclient
3.5.19
PPC Linux
: P5 major
: ---
Assigned To: Jeremy Allison
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-12-04 07:03 UTC by Dheeraj Reddy
Modified: 2012-12-13 10:52 UTC (History)
1 user (show)

See Also:


Attachments
TreeView operations of Samba (2.80 MB, text/plain)
2012-12-04 07:39 UTC, Dheeraj Reddy
no flags Details
Patch for 3.5.x (692 bytes, patch)
2012-12-07 23:47 UTC, Jeremy Allison
no flags Details
git-am fix for 3.5.x (1.06 KB, patch)
2012-12-10 18:59 UTC, Jeremy Allison
vl: review+
jra: review? (metze)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Dheeraj Reddy 2012-12-04 07:03:04 UTC
In file samba-3.5.16/source3/lib/util_unistr.c 
unmap_file(valid_table, 0x10000); is called everytime even though mapping for valid table is not done every time.

In function void init_valid_table(void) mapping for valid_table is done once and returned thereafter.

But in function void gfree_case_tables(void) munmap is called everytime.
Comment 1 Dheeraj Reddy 2012-12-04 07:39:03 UTC
Created attachment 8272 [details]
TreeView operations of Samba

	Thirdparty samba is calling mmap three times at first tree view.
	Ref:	panel.txt line 8459, line 8461 and line 8465.

	All created mmap are cleared by calling munmap for first time.
	Ref:	panel.txt line 8609, line 8612 and line 8615.
	
	After that for next tree views, only two mmap are getting called.
	Ref: 	panel.txt line 23834 and line 23836.

	But three mmap are getting cleared by calling munmap.
	Ref: 	panel.txt line 23982, line 23985 and line 23988.
If third memory location is already assigned to some other process, then samba is unmapping the memory.If process whcih has mapped the memory location access the memory then crash is observed.
Comment 2 Dheeraj Reddy 2012-12-04 07:39:17 UTC
	Thirdparty samba is calling mmap three times at first tree view.
	Ref:	panel.txt line 8459, line 8461 and line 8465.

	All created mmap are cleared by calling munmap for first time.
	Ref:	panel.txt line 8609, line 8612 and line 8615.
	
	After that for next tree views, only two mmap are getting called.
	Ref: 	panel.txt line 23834 and line 23836.

	But three mmap are getting cleared by calling munmap.
	Ref: 	panel.txt line 23982, line 23985 and line 23988.
If third memory location is already assigned to some other process, then samba is unmapping the memory.If process whcih has mapped the memory location access the memory then crash is observed.
Comment 3 Jeremy Allison 2012-12-07 23:47:29 UTC
Created attachment 8306 [details]
Patch for 3.5.x

Can you test this patch and see if it fixes the issue for you ?

This has already been fixed in 3.6.x and above.

Jeremy.
Comment 4 Dheeraj Reddy 2012-12-10 05:12:02 UTC
(In reply to comment #3)
> Created attachment 8306 [details]
> Patch for 3.5.x
> 
> Can you test this patch and see if it fixes the issue for you ?
> 
> This has already been fixed in 3.6.x and above.
> 
> Jeremy.

This fix is working fine.
Thanks for your quick response.
Comment 5 Jeremy Allison 2012-12-10 18:59:56 UTC
Created attachment 8333 [details]
git-am fix for 3.5.x

Not sure if we're still doing 3.5.x updates, but just in case we are :-).

Jeremy.
Comment 6 Volker Lendecke 2012-12-11 09:15:53 UTC
Comment on attachment 8333 [details]
git-am fix for 3.5.x

                if ( upcase_table_use_unmap ) {
                        unmap_file(upcase_table, 0x20000);
                        upcase_table = NULL;
                } else {
                        SAFE_FREE(upcase_table);
                }

would more what I would have done, but this will certainly also fix it.
Comment 7 Karolin Seeger 2012-12-12 11:16:22 UTC
Samba 3.5.20 will be the last 3.5 bugfix release and is scheduled for Monday.
Pushed patch to v3-5-test.

Assuming it's 3.5 only.
Comment 8 Jeremy Allison 2012-12-13 10:52:25 UTC
Yes it is 3.5.x only.