From 68c5c6df0eeae16c56d0abc1b5ec275d18410224 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Sun, 24 May 2009 18:57:13 +0200 Subject: [PATCH] Fix a race condition in winbind leading to a panic In winbind, we do multiple events in one select round. This needs fixing, but as long as we're still using it, for efficiency reasons we need to do that. What can happen is the following: We have outgoing data pending for a client, thus state->fd_event.flags == EVENT_FD_WRITE Now a new client comes in, we go through the list of clients to find an idle one. The detection for idle clients in remove_idle_client does not take the pending data into account. We close the socket that has pending outgoing data, the accept(2) one syscall later gives us the same socket. In new_connection(), we do a setup_async_read, setting up a read fde. The select from before however had found the socket (that we had already closed!!) to be writable. In rw_callback we only want to see a readable flag, and we panic in the SMB_ASSERT(flags == EVENT_FD_READ). Found using bin/smbtorture //127.0.0.1/tmp -U% -N 500 -o 2 local-wbclient Volker --- source3/winbindd/winbindd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c index 52517b01bbe..e1ce2234759 100644 --- a/source3/winbindd/winbindd.c +++ b/source3/winbindd/winbindd.c @@ -905,6 +905,7 @@ static bool remove_idle_client(void) for (state = winbindd_client_list(); state; state = state->next) { if (state->response.result != WINBINDD_PENDING && + state->fd_event.flags == EVENT_FD_READ && !state->getpwent_state && !state->getgrent_state) { nidle++; if (!last_access || state->last_access < last_access) { -- 2.34.1