Winbindd using 100% of CPU. Any solution?

Richard Sharpe realrichardsharpe at gmail.com
Wed Dec 4 12:49:49 MST 2013


On Wed, Dec 4, 2013 at 11:27 AM, Jeremy Allison <jra at samba.org> wrote:
> On Wed, Dec 04, 2013 at 11:11:46AM -0800, Richard Sharpe wrote:
>>
>> Those line numbers seem messed up. I caught it in talloc_free, so it
>> looks like we are in a loop here:
>>
>>         for (domain = domain_list(); domain; domain = domain->next) {
>>                 TALLOC_FREE(domain->check_online_event);
>>         }
>>
>> Here is what the list of domain looks like and the prev pointers are
>> seriously messed up:
>
> Yes, we know that. The problem is finding out *HOW*
> the pointers got messed up :-(.

OK, after fixing my line numbers, I now find that we are looping here:

        /* Destroy all possible events in child list. */
        for (cl = winbindd_children; cl != NULL; cl = cl->next) {
                TALLOC_FREE(cl->lockout_policy_event);
                TALLOC_FREE(cl->machine_password_change_event);

                /* Children should never be able to send
                 * each other messages, all messages must
                 * go through the parent.
                 */
                cl->pid = (pid_t)0;

                /*
                 * Close service sockets to all other children
                 */
                if ((cl != myself) && (cl->sock != -1)) {
                        close(cl->sock);
                        cl->sock = -1;
                }
        }

and the winbindd_children list is seriously screwed in a couple of ways:

(gdb) p winbindd_children
$22 = (struct winbindd_child *) 0x803358940
(gdb) p *winbindd_children
$23 = {next = 0xeac360, prev = 0x8033589a0, pid = 0, domain = 0x803345400,
  logfilename = 0x8033d7c80 "/var/log/samba/log.wb-XCHANGE", sock = -1,
  queue = 0x8033d7c50, binding_handle = 0x8033d7d50, lockout_policy_event = 0x0,
  machine_password_change_event = 0x0, table = 0xe09580}
(gdb) p *(winbindd_children->next)
$24 = {next = 0x803358940, prev = 0x803358940, pid = 0, domain = 0x0,
  logfilename = 0x803330300 "/var/log/samba/log.winbindd-idmap", sock = -1,
  queue = 0x8033302d0, binding_handle = 0x8033303d0, lockout_policy_event = 0x0,
  machine_password_change_event = 0x0, table = 0xe09680}

The last element points back to itself, which is the cause of the
infinite loop, but the first element has a weird value in its next
pointer ...

-- 
Regards,
Richard Sharpe
(何以解憂?唯有杜康。--曹操)


More information about the samba-technical mailing list