[SCM] Samba Shared Repository - branch v3-0-test updated -
release-3-0-32-44-gcfa9d20
Jeremy Allison
jra at samba.org
Wed Oct 8 18:40:22 GMT 2008
The branch, v3-0-test has been updated
via cfa9d20db78875969ea8065161f8efdf5281d003 (commit)
from 45514fc5d85221339a4ee55b9f9f78c917b2fd19 (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-0-test
- Log -----------------------------------------------------------------
commit cfa9d20db78875969ea8065161f8efdf5281d003
Author: Jeremy Allison <jra at samba.org>
Date: Wed Oct 8 11:37:43 2008 -0700
Fix bug #5814 - Winbindd dumping core in a strange manner while doing "rescan_trusted_domain".
From analysis by hargagan <shargagan at novell.com> :
"The winbindd_child_died() is also getting called from process_loop() in case of
SIGCHLD signal. In this case it doesn't make the timeout_handler to NULL for
the first request. It then initiate a new request using
schedule_async_request() which installs a new timeout handler for the same
request. In such a case, for a badly unresponsive system both the timeout
handler can be called. For the first call the "private_data" will be cleared
and for another call the timeout handler will be detecting the double free. So,
for such a case as well, the winbindd_child_died() should make the
timeout_handler to NULL."
Jeremy.
-----------------------------------------------------------------------
Summary of changes:
source/nsswitch/winbindd_dual.c | 23 +++++++++++++++++++++++
1 files changed, 23 insertions(+), 0 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source/nsswitch/winbindd_dual.c b/source/nsswitch/winbindd_dual.c
index 84c9a1c..106bb48 100644
--- a/source/nsswitch/winbindd_dual.c
+++ b/source/nsswitch/winbindd_dual.c
@@ -294,6 +294,18 @@ static void schedule_async_request(struct winbindd_child *child)
return; /* Busy */
}
+ /*
+ * This may be a reschedule, so we might
+ * have an existing timeout event pending on
+ * the first entry in the child->requests list
+ * (we only send one request at a time).
+ * Ensure we free it before we reschedule.
+ * Bug #5814, from hargagan <shargagan at novell.com>.
+ * JRA.
+ */
+
+ TALLOC_FREE(request->reply_timeout_event);
+
if ((child->pid == 0) && (!fork_domain_child(child))) {
/* fork_domain_child failed.
Cancel all outstanding requests */
@@ -539,6 +551,17 @@ void winbind_child_died(pid_t pid)
child->event.flags = 0;
child->pid = 0;
+ if (child->requests) {
+ /*
+ * schedule_async_request() will also
+ * clear this event but the call is
+ * idempotent so it doesn't hurt to
+ * cover all possible future code
+ * paths. JRA.
+ */
+ TALLOC_FREE(child->requests->reply_timeout_event);
+ }
+
schedule_async_request(child);
}
--
Samba Shared Repository
More information about the samba-cvs
mailing list