[PATCH] (partial) tevent_req_poll() loops for ever....

[boyang]

Volker Lendecke wrote:
> On Mon, Apr 20, 2009 at 10:04:55AM -0600, Bo Yang wrote:
>   
>> Taking cm_connect_lsa() for example. Assuming network
>> connectionis good initially, but when
>> cli_rpc_pipe_open_spnego_ntlmssp() isinvoked, remote end
>> is closed. So, it returnsNT_STATUS_BROKEN_PIPE(mapped from
>> EPIPE). Then we go to schannel oranonymous, which makes no
>> difference. Because the socket is brokennow(but fd is
>> owned by current process, winbindd), the fd(socket)
>> won'tbe writable or readable any more. Then have a look at
>> whattevent_req_poll() does, req is always in progress,
>> tevent_loop_once()--> s3_event_loop_once() ---> add the fd
>> to select's writefds set---> select times out and returns
>> 0. again and again,tevent_req_poll() loops forever........
>>
>> I think we should do a test after each rpc call to see if
>> thestatus is BROKEN PIPE, if it is, we must close the
>> socket and free allpipes. We must close socket first, and
>> set cli->fd to -1. Otherwise,pipe's destructor will try to
>> write to the fd, which causetevent_req_poll() loops
>> forever. My previous patch to test ifcli->fd must be there
>> to make this work, otherwise, winbindd justcrash in
>> FD_SET(-1, &writefds)....
>>     
>
> Isn't it that we eventually end up in an smb request? What
> happens if we close the fd at the right place?
>
> What about the attached patch?
>   
looks like it will work for name pipe and transport smbd. it won't work
with ncacn_ip_tcp and ncalrpc.
> Volker
>   
> ------------------------------------------------------------------------
>
> diff --git a/source3/libsmb/async_smb.c b/source3/libsmb/async_smb.c
> index 7afba0d..96b7054 100644
> --- a/source3/libsmb/async_smb.c
> +++ b/source3/libsmb/async_smb.c
> @@ -742,6 +742,10 @@ static void cli_smb_sent(struct tevent_req *subreq)
>  	nwritten = writev_recv(subreq, &err);
>  	TALLOC_FREE(subreq);
>  	if (nwritten == -1) {
> +		if (err == EPIPE) {
> +			close(state->cli->fd);
> +			state->cli->fd = -1;
> +		}
>  		tevent_req_nterror(req, map_nt_error_from_unix(err));
>  		return;
>  	}
> @@ -787,6 +791,10 @@ static void cli_smb_received(struct tevent_req *subreq)
>  	received = read_smb_recv(subreq, talloc_tos(), &inbuf, &err);
>  	TALLOC_FREE(subreq);
>  	if (received == -1) {
> +		if (err == EPIPE) {
> +			close(cli->fd);
> +			cli->fd = -1;
> +		}
>  		status = map_nt_error_from_unix(err);
>  		goto fail;
>  	}
>   


-- 
Bo Yang, Software Engineer, Suse Labs
GPG-key-ID   538C4C1A
Samba Team   boyang at samba.org    http://www.samba.org/
Suse Linux   boyang at suse.de      http://www.novell.com/